CVE-2025-13031

MediumCVSS 5.9/10Last modified Oct 7, 2026

Description

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Affected software

Vendor	Product	Versions
Unknown	WPeMatico RSS Feed Fetcher	< 2.8.13

References

Timeline

Published: Dec 9, 2025
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-130327.8Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool overflo CVE-2025-130337.5A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An at CVE-2025-130345.9When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, curl should check the public key of the ser CVE-2025-130358.0The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.9.1. This is due to the p CVE-2025-130369.2An authentication bypass security issue exists within FactoryTalk Historian Site Edition. By continually sending requests to the login endpo CVE-2025-13048.8The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and CVE-2025-130428.8Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption CVE-2025-130446.2IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a CVE-2025-130486.4The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's Nickname in CVE-2025-13058.8The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due t CVE-2025-130505.4Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user CVE-2025-130519.3When the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL wit