FeedWordPress

Featured

Posted on July 24, 2009 by C. Johnson

FeedWordPress is an open-source Atom/RSS aggregator for the WordPress blog publishing platform. You set up feeds that you choose, and FeedWordPress syndicates posts from those sources into your WordPress posts table, where they can be displayed by your WordPress templates like any other post — but with additional meta-data, so that your templates can properly attribute the post to the source it came from.

FeedWordPress was originally developed because I needed a more flexible replacement for Planet to use at some aggregator sites that I administered. You can use FeedWordPress to create aggregator sites that bring together posts from many different sources, using the WordPress templating engine to display posts from all around the web. Or you can use it to bring together activity from your blogs, social networks and other online services, into a Lifestream with all your online activity in one place.

FeedWordPress is designed with flexibility, ease of use, and ease of configuration in mind. You’ll need a working installation of WordPress (version 6.2 or later), and the ability to add plugins to your WordPress environment, either using WordPress’s Add Plugin feature or SFTP/FTP uploads. The ability to create cron jobs on your web host is helpful but not required.

Release 2026.1030 – Security hardening and bug fix release. New minimum WordPress version of 6.2 or higher.

Posted on October 30, 2026 by C. Johnson

A new release of FeedWordPress (2026.1030) is available from FeedWordPress’s page on the WordPress Plugins Repository and from FeedWordPress’s page at Github. This release includes (1) a SECURITY UPDATE providing a significant security-hardening change in content policy, addressing the changing security environment and XSS or related threats that could arise if one of the feeds you subscribed to turns out to be malicious or is compromised (this update addresses the forthcoming vulnerability report CVE-2026-110530; thanks to Adrien Brunner and Wordfence for raising the issue) (2) a BUG FIX that resolves a bug that caused some feeds updates to hang or fail when a syndicated post included a long author URL (this is more common in comment feeds including pingbacks than in main content feeds), and (3) a WORDPRESS VERSION COMPATIBILITY CHANGE (this release requires a minimum of WordPress 6.2+; it is tested up to the latest WordPress 7.1.4 release). I recommend you upgrade both WordPress and FeedWordPress to the latest versions to get all the new security updates.

From the changelog:

= 2026.1030 =

BUG FIX FOR FEED UPDATES HANGING ON SOME FEEDS WITH LONG AUTHOR URLS: You may have encountered a bug preventing some feeds from completing a full update when the author URL for a post is too long — most often, this appears when syndicating comment feeds, which may include long full post URLs when listing pingbacks in the feed. This update catches that and should allow updates to complete successfully. Tested and co-authored with Claude (Anthropic).

= 2026.1016 =

SECURITY HARDENING: SYNDICATED CONTENT NOW TREATED AS UNTRUSTED HTML, FILTERED THROUGH WORDPRESS KSES: Syndicated post content and excerpts now always go through WordPress’s KSES sanitizer before content is stored, to filter out potentially malicious content. Previous versions made a policy decision to avoid KSES filtering and possible collateral damage to valid layout markup, on the use-at-your-own-peril assumption that you would subscribe to syndication sources whose HTML you can trust. In today’s security environment that no longer seems like the right trade-off; I have received requests to adopt a more security-hardened policy, and I agree that these requests are reasonable. Syndicated content is now filtered through KSES as untrusted HTML; but audiovisual embeds from YouTube, Vimeo and Spotify, as well as video and audio tags, are preserved from being filtered out, and fixed or sticky CSS positioning is also stripped out of syndicated HTML elements. iframe elements from sites not explicitly allowed, HTML forms, and some other interactive elements, are stripped out during sanitizing. Developers can adjust embedding rules for their own use case using the feedwordpress_allow_syndicated_embeds and feedwordpress_allowed_iframe_hosts filters. Content is filtered at the time of syndication; existing posts are not affected by this update unless you erase and resyndicate them, or updated versions appear on the source feed. Thanks to Adrien Brunner and Wordfence for the report. Analysis and patch drafted with help from Claude (Anthropic). Addresses CVE-2026-110530.
WORDPRESS VERSION SUPPORT: NOW REQUIRES WORDPRESS 6.2 OR LATER: I’m dropping testing and version support for versions of WordPress prior to version 6.2; some of the new filtering code depends on WordPress 6.2 or later.