{
 "id": "WPSEC-2026-1044",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1044/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1044/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1044/index.md",
 "title": "WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via Imported Feed Content",
 "description": "The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported feed items in all versions up to, and including, 2.9. This is due to insufficient sanitization of the content, title, excerpt, image URLs and post template variables taken from remote feeds. The post insert could also disable kses for campaigns allowed unfiltered HTML. This makes it possible for unauthenticated attackers who control a feed that a campaign fetches to inject arbitrary web scripts into published posts, which execute whenever a user views them.",
 "plugin": {
  "slug": "wpematico",
  "name": "WPeMatico RSS Feed Fetcher",
  "full_name": "WPeMatico RSS Feed Fetcher",
  "wordpress_org": "https://wordpress.org/plugins/wpematico/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpematico/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpematico"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.9.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.9.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.9.1",
 "remediation": "Update to 2.9.1 or later.",
 "fix_released": "2026-10-15T01:51:03+00:00",
 "published": "2026-10-16T02:40:32+00:00",
 "updated": "2026-10-15T08:16:01.828482+00:00",
 "also_published_as": {
  "source": "wordfence",
  "cve": [
   "CVE-2026-110252"
  ],
  "published": "2026-10-15T17:49:04+00:00"
 },
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1044/",
  "https://plugins.svn.wordpress.org/wpematico/tags/2.9.1/",
  "https://wordpress.org/plugins/wpematico/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpematico",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-15"
 }
}