Stored Cross-Site Scripting Vulnerability in WPeMatico RSS Feed Fetcher by WordPress
CVE-2025-13031
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 December 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-13031?
The WPeMatico RSS Feed Fetcher plugin for WordPress, prior to version 2.8.13, contains a vulnerability where certain settings are not properly sanitized or escaped. This lack of validation can be exploited by users with elevated privileges, such as contributors, to execute Stored Cross-Site Scripting (XSS) attacks. Such vulnerabilities can allow malicious scripts to be injected and executed in the context of a user's session, potentially compromising sensitive data and site integrity if exploited.
Affected Version(s)
WPeMatico RSS Feed Fetcher 0 < 2.8.13
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.