CVE-2026-57349: WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.17 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPeMatico RSS Feed Fetcherto a version that resolves this vulnerability.Fixed in 2.8.18
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue is described as unauthenticated XSS, so an attacker does not need a WordPress account or plugin-level privileges. Exploitation still requires user interaction, as indicated by the UI:R vector.
Which installations should be treated as affected?
Installations using WPeMatico RSS Feed Fetcher version 2.8.17 or earlier should be treated as affected based on the available information.
What is the likely security impact if exploitation succeeds?
The supplied CVSS vector indicates low impacts to confidentiality, integrity, and availability, with scope changed. In practice, XSS can execute attacker-controlled script in a user’s browser within the affected site’s context.