fetch_rss() uses incorrect function signature for XML `start_element_handler`

[avibrender]

We have a plugin that relies on fetch_rss, which uses MagpieRSS. We found this warning in the logs

[30-Nov-2025 18:44:05 UTC] PHP Warning:  MagpieRSS::feed_start_element(): Argument #3 ($attrs) must be passed by reference, value given in /path/to/web/wp-includes/rss.php on line 81

We tracked this warning down to ​`feed_start_element` on line 112 :

function feed_start_element($p, $element, &$attrs) {

This is the start_handler that is passed to xml_set_element_handler at ​line 78 .

However the PHP documentation at ​https://www.php.net/manual/en/function.xml-set-element-handler.php shows:

"The signature of the handler must be:"

start_element_handler(XMLParser $parser, string $name, array $attributes): void

Perhaps the 3rd parameter of feed_start_element should be $attrs instead of &$attrs ?

Thanks!

[manhphucofficial]

Remove reference from $attrs to match XML parser handler signature

[manhphucofficial]

I’ve prepared a patch that removes the reference from $attrs in feed_start_element() to match the required handler signature for xml_set_element_handler().

PHP’s XML parser always passes the attributes array by value, and the official handler signature is:

start_element_handler(XMLParser $parser, string $name, array $attributes): void

Using &$attrs triggers this PHP 8+ warning:

“Argument #3 ($attrs) must be passed by reference, value given”

The function only normalizes $attrs internally and does not require a reference, so removing & is safe and keeps behavior unchanged.

Before patch:

• Warning is triggered every time fetch_rss() runs.

After patch:

• No warning, feed parsing remains correct.

Patch attached. Thanks!

[westonruter]

Since MagpieRSS has been deprecated for a long time (since WP v3.0), shouldn't any code which depends on it really be updated to use SimplePie? This would be the best outcome.

[manhphucofficial]

Thanks for the insightful feedback!

Fully migrating away from MagpieRSS in favor of SimplePie would indeed be the ideal long-term solution, and I completely agree that the existing dependency on MagpieRSS should ultimately be removed.

In the meantime, since fetch_rss() and legacy integrations still invoke MagpieRSS in current installations, this PHP 8 warning affects real-world sites today. The small change in the attached patch avoids the warning without altering behavior or introducing additional maintenance burden.

The patch is intended as a safe, minimal, interim fix that prevents unnecessary noise in PHP logs while the broader architectural update (migrating to SimplePie or removing MagpieRSS) is being considered.

Happy to adjust or refine the patch if that helps move things forward. Thanks again!

[sabernhardt]

Since MagpieRSS has been deprecated for a long time (since WP v3.0)

Related: #57107