Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110252— WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import

Quick assessment

Affected
etruel WPeMatico RSS Feed Fetcher
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 WPeMatico RSS Feed Fetcher 插件在 2.9 及以下版本中存在存储型跨站脚本（Stored XSS）漏洞。该漏洞的成因是：当某次导入活动的最后编辑者拥有 权限时，插件会在调用 插入 RSS 内容之前，立即从 钩子中移除 WordPress 内置的 过滤器。而该插件会自动为每位管理员保存的导入活动设置此权限标志。 导入项的内容直接从 获取，仅进行实体解码后便原样存入 字段。这使得未认证的攻击者能够通过发布或篡改管理员已订阅的 RSS 源，向 WPeMatico 导入活动

CVSS 5.4 · Medium EPSS 0.29% · P20

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 1

VendorProduct Version RangeStatus
etruel WPeMatico RSS Feed Fetcher ≤ 2.9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110252

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import
Source: CVE Program / CVE List V5
Vulnerability Description
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress's wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() with RSS feed content, whenever the campaign's last editor had the unfiltered_html capability — a flag the plugin sets automatically for every admin-saved campaign. Imported item content is taken raw from $item->get_content(), only entity-decoded, and stored verbatim in post_content. This makes it possible for unauthenticated attackers, who publish or compromise an RSS feed that an administrator has subscribed a WPeMatico campaign to, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected imported post.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
etruel WPeMatico RSS Feed Fetcher 0 ~ 2.9 -

II. Public POCs for CVE-2026-110252

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110252

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110252 (1)

Vendor Advisories for CVE-2026-110252 (1)

IV. Related Vulnerabilities

Same product: WPeMatico RSS Feed Fetcher
Same vendor: etruel
Same weakness: CWE-79

V. Comments for CVE-2026-110252

No comments yet

Leave a comment