Description
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_category' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is persisted in post meta as campaign_data, bypassing wp_kses sanitization, and executes in the browser session of any user with edit_posts — including Administrators — who opens the WPeMatico campaigns list screen.
Metrics
CVSS 3.1 6.4/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| etruel | WPeMatico RSS Feed Fetcher | <= 2.9.1 |
References
- https://github.com/etruel/wpematico/tree/2.9.2
- https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/campaign_edit.php#L540
- https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/campaigns_list.php#L820
- https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9.1/includes/wpematico_functions.php#L1106
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d93d4360-b66c-499a-838c-e8eea36bd364?source=cve
Timeline
- Published
- Nov 13, 2026
- Last modified
- Nov 13, 2026
- NVD status
- Deferred