{"schema":"threatline.record/2","record":{"id":"CVE-2026-110252","aliases":[],"summary":"WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import","details":"The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress's wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() with RSS feed content, whenever the campaign's last editor had the unfiltered_html capability — a flag the plugin sets automatically for every admin-saved campaign. Imported item content is taken raw from $item->get_content(), only entity-decoded, and stored verbatim in post_content. This makes it possible for unauthenticated attackers, who publish or compromise an RSS feed that an administrator has subscribed a WPeMatico campaign to, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected imported post.","categories":["Unclassified"],"product":"WPeMatico RSS Feed Fetcher","vendor":"etruel","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110252","source_modified_at":"2026-10-16T14:39:02.268Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"WPeMatico RSS Feed Fetcher","vendor":"etruel","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.9","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00288,"percentile":0.20262,"score_date":"2026-10-23"},"published_at":"2026-10-16T06:41:06.918Z","modified_at":"2026-10-16T14:39:02.268Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-110252","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T14:39:02.268Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110252","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e87fc1bf-af05-4089-a164-8a2e73c68e8c?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9/includes/campaign_fetch.php#L400"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9/includes/wpematico_functions.php#L3226"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9/includes/campaign_fetch.php#L777"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9/includes/campaign_fetch.php#L773"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/wpematico/tags/2.9/includes/wpematico_functions.php#L3326"},{"source":"CVE List","url":"https://github.com/etruel/wpematico/commit/44c4894a0ad92a711c534ad4d822c0b5d7c3dffe"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset/3747465/wpematico/trunk/includes/campaign_fetch.php"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-16T14:33:52.898447Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T14:39:02.268Z","content_hash":"cfe120e60122c822897c1e05f739c49475ec67b341afd017dd26af39e3c49570"}}