Stored Cross-Site Scripting Vulnerability in WPeMatico RSS Feed Fetcher Plugin for WordPress

CVE-2026-110252

What is CVE-2026-110252?

The WPeMatico RSS Feed Fetcher plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability in its versions up to and including 2.9. This flaw arises because the plugin bypasses WordPress's built-in wp_filter_post_kses filter when saving content from RSS feeds, particularly if the last editor has unfiltered_html capabilities. As a result, malicious attackers can exploit this vulnerability by injecting arbitrary web scripts into posts through compromised or malicious RSS feeds. Such scripts can be executed whenever a user accesses an affected post, posing a significant security risk to users and site integrity.

References