WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via Imported Feed Content
- ID
- WPSEC-2026-1044
- Plugin
- WPeMatico RSS Feed Fetcher (wpematico)
- Affected
- all versions before 2.9.1
- Remediation
- Update to 2.9.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-15
- Attack surface
- WPeMatico RSS Feed Fetcher on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-110252, on 2026-10-15.
Description
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported feed items in all versions up to, and including, 2.9. This is due to insufficient sanitization of the content, title, excerpt, image URLs and post template variables taken from remote feeds. The post insert could also disable kses for campaigns allowed unfiltered HTML. This makes it possible for unauthenticated attackers who control a feed that a campaign fetches to inject arbitrary web scripts into published posts, which execute whenever a user views them.
References
- https://wpsec.com/vuln/WPSEC-2026-1044/
- https://plugins.svn.wordpress.org/wpematico/tags/2.9.1/
- https://wordpress.org/plugins/wpematico/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS