# WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via Imported Feed Content

- **ID:** WPSEC-2026-1044
- **Plugin:** WPeMatico RSS Feed Fetcher (`wpematico`), https://wordpress.org/plugins/wpematico/
- **Affected versions:** all versions before 2.9.1
- **Fixed in:** 2.9.1 (Update to 2.9.1 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpematico
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1044/

## Description

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported feed items in all versions up to, and including, 2.9. This is due to insufficient sanitization of the content, title, excerpt, image URLs and post template variables taken from remote feeds. The post insert could also disable kses for campaigns allowed unfiltered HTML. This makes it possible for unauthenticated attackers who control a feed that a campaign fetches to inject arbitrary web scripts into published posts, which execute whenever a user views them.

Also published later by wordfence as CVE-2026-110252.

## References

- https://wpsec.com/vuln/WPSEC-2026-1044/
- https://plugins.svn.wordpress.org/wpematico/tags/2.9.1/
- https://wordpress.org/plugins/wpematico/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1044/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.