A new release of FeedWordPress (2026.1030) is available from FeedWordPress’s page on the WordPress Plugins Repository and from FeedWordPress’s page at Github. This release includes (1) a SECURITY UPDATE providing a significant security-hardening change in content policy, addressing the changing security environment and XSS or related threats that could arise if one of the feeds you subscribed to turns out to be malicious or is compromised (this update addresses the forthcoming vulnerability report CVE-2026-110530; thanks to Adrien Brunner and Wordfence for raising the issue) (2) a BUG FIX that resolves a bug that caused some feeds updates to hang or fail when a syndicated post included a long author URL (this is more common in comment feeds including pingbacks than in main content feeds), and (3) a WORDPRESS VERSION COMPATIBILITY CHANGE (this release requires a minimum of WordPress 6.2+; it is tested up to the latest WordPress 7.1.4 release). I recommend you upgrade both WordPress and FeedWordPress to the latest versions to get all the new security updates.

From the changelog:

= 2026.1030 =

• BUG FIX FOR FEED UPDATES HANGING ON SOME FEEDS WITH LONG AUTHOR URLS: You may have encountered a bug preventing some feeds from completing a full update when the author URL for a post is too long — most often, this appears when syndicating comment feeds, which may include long full post URLs when listing pingbacks in the feed. This update catches that and should allow updates to complete successfully. Tested and co-authored with Claude (Anthropic).

= 2026.1016 =

• SECURITY HARDENING: SYNDICATED CONTENT NOW TREATED AS UNTRUSTED HTML, FILTERED THROUGH WORDPRESS KSES: Syndicated post content and excerpts now always go through WordPress’s KSES sanitizer before content is stored, to filter out potentially malicious content. Previous versions made a policy decision to avoid KSES filtering and possible collateral damage to valid layout markup, on the use-at-your-own-peril assumption that you would subscribe to syndication sources whose HTML you can trust. In today’s security environment that no longer seems like the right trade-off; I have received requests to adopt a more security-hardened policy, and I agree that these requests are reasonable. Syndicated content is now filtered through KSES as untrusted HTML; but audiovisual embeds from YouTube, Vimeo and Spotify, as well as video and audio tags, are preserved from being filtered out, and fixed or sticky CSS positioning is also stripped out of syndicated HTML elements. iframe elements from sites not explicitly allowed, HTML forms, and some other interactive elements, are stripped out during sanitizing. Developers can adjust embedding rules for their own use case using the feedwordpress_allow_syndicated_embeds and feedwordpress_allowed_iframe_hosts filters. Content is filtered at the time of syndication; existing posts are not affected by this update unless you erase and resyndicate them, or updated versions appear on the source feed. Thanks to Adrien Brunner and Wordfence for the report. Analysis and patch drafted with help from Claude (Anthropic). Addresses CVE-2026-110530.
• WORDPRESS VERSION SUPPORT: NOW REQUIRES WORDPRESS 6.2 OR LATER: I’m dropping testing and version support for versions of WordPress prior to version 6.2; some of the new filtering code depends on WordPress 6.2 or later.