CVE-2026-110252: WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress's wpfilterpostkses filter from contentsavepre immediately before calling wpinsertpost() with RSS feed content, whenever the campaign's last editor had the unfilteredhtml capability — a flag the plugin sets automatically for every admin-saved campaign. Imported item content is taken raw from $item->getcontent(), only entity-decoded, and stored verbatim in postcontent. This makes it possible for unauthenticated attackers, who publish or compromise an RSS feed that an administrator has subscribed a WPeMatico campaign to, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected imported post.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites with WPeMatico campaigns that subscribe to an RSS feed are exposed when the campaign was saved by an administrator. The plugin automatically marks admin-saved campaigns as having unfiltered HTML capability, causing imported feed content to be stored without the normal WordPress post-content filtering.
What does an attacker need to exploit it?
An attacker does not need an account on the WordPress site. They need to publish a malicious RSS feed, or compromise a feed already configured in a WPeMatico campaign, so that the campaign imports attacker-controlled item content.
When does the injected script execute?
The malicious content is stored in the imported post's post_content field. Its scripts execute when a user accesses an imported post containing the injected content.
How can I investigate possible exposure?
Identify WPeMatico campaigns saved by administrators and review the RSS sources they import from. Inspect posts imported by those campaigns for unexpected raw HTML or script content in the stored post content.