CVE-2026-110252 in WPeMatico RSS Feed Fetcher Plugin
Summary
by MITRE • 10/16/2026
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress's wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() with RSS feed content, whenever the campaign's last editor had the unfiltered_html capability — a flag the plugin sets automatically for every admin-saved campaign. Imported item content is taken raw from $item->get_content(), only entity-decoded, and stored verbatim in post_content. This makes it possible for unauthenticated attackers, who publish or compromise an RSS feed that an administrator has subscribed a WPeMatico campaign to, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected imported post.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in the WPeMatico RSS Feed Fetcher plugin for WordPress versions up to and including 2.9 represents a critical Stored Cross-Site Scripting flaw rooted in improper input validation and privilege escalation mechanisms within the plugin's content processing logic. The core technical issue arises from the deliberate removal of WordPress's built-in sanitization filter, wp_filter_post_kses, which is normally applied during the content_save_pre action to strip dangerous HTML tags and scripts before data storage. By stripping this protection immediately prior to invoking wp_insert_post(), the plugin bypasses standard security controls that are designed to prevent malicious code injection into post content fields. This architectural decision creates a direct pathway for attackers to inject arbitrary web scripts, which are then stored in the database alongside legitimate site content.
The exploitation of this vulnerability is facilitated by an automatic privilege escalation mechanism inherent to how campaigns are managed within the plugin. When an administrator saves a campaign configuration, the system automatically assigns the unfiltered_html capability to that specific campaign's editor context. This capability normally allows users with administrative privileges to bypass standard sanitization filters for legitimate purposes, such as embedding complex media or custom HTML structures. However, in this implementation, the assignment of this elevated privilege is unconditional and applies regardless of whether the incoming content from an RSS feed has been verified for safety. Consequently, any content imported via wp_insert_post under this context retains its raw structure without sanitization, provided it was processed by a campaign associated with that administrator account.
The operational impact of this vulnerability allows unauthenticated attackers to execute arbitrary JavaScript code in the browsers of users who view posts generated from compromised RSS feeds. The attack vector relies on the attacker controlling or compromising an external RSS feed source that is subscribed to by a victim site running WPeMatico. By injecting malicious script tags into the item content field, specifically leveraging $item->get_content(), which only performs entity decoding without further sanitization, the attacker ensures that the payload persists in the database. When any user accesses a page displaying this imported post, their browser executes the injected scripts, leading to potential session hijacking, credential theft, defacement of the website, or redirection to malicious sites. This is particularly dangerous because it affects all users viewing the content, not just administrators, thereby expanding the blast radius significantly beyond the initial point of compromise.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under Stored XSS where malicious scripts are permanently stored within target applications, such as databases or message forums, and later delivered to users when they request information from the application. In terms of adversarial tactics, this aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically JavaScript execution via web browsers, which is often used for initial access or persistence in compromised environments. The lack of output encoding combined with input validation bypass creates a high-severity risk that undermines the integrity and confidentiality of the WordPress installation.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade WPeMatico to a version where this vulnerability has been patched, ensuring that wp_filter_post_kses is not removed or that alternative sanitization methods are applied before database insertion. Administrators should also audit their RSS feed subscriptions to ensure they only trust sources from reputable and secure providers. Implementing Content Security Policy headers can help mitigate the impact of any successful XSS attacks by restricting the domains from which scripts can be loaded, although this is a compensating control rather than a fix for the underlying flaw. Additionally, enforcing strict least-privilege principles in plugin configurations and avoiding automatic elevation of unfiltered_html capabilities without explicit user consent or validation checks would prevent similar vulnerabilities in future updates. Regular security audits and code reviews focusing on how plugins handle external data inputs are essential to maintaining robust WordPress security postures.