CVE-2026-120573: WPeMatico RSS Feed Fetcher <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_category' Parameter
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcategory' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is persisted in post meta as campaigndata, bypassing wpkses sanitization, and executes in the browser session of any user with editposts — including Administrators — who opens the WPeMatico campaigns list screen.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the stored payload?
An authenticated WordPress user with Contributor-level access or higher can inject the payload through the post_category parameter. The payload executes when a user who has the edit_posts capability, including an Administrator, opens the WPeMatico campaigns list screen.
Are sites running the affected plugin version exposed by default?
Exposure requires that an attacker can authenticate with a Contributor-or-higher account and submit a malicious post_category value. Execution additionally requires an edit_posts-capable user to access the WPeMatico campaigns list screen.
How does the malicious content persist?
The injected payload is stored in post meta as campaign_data. This storage path bypasses wp_kses sanitization, allowing the script to remain until the affected data is removed.