PT-2026-54992

CVE-2026-57349

Published

2026-07-01

Updated

2026-07-02

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.18

Description The WPeMatico RSS Feed Fetcher plugin for WordPress contains a stored Cross-Site Scripting (XSS) flaw. This issue occurs because the software fails to properly sanitize input and escape output, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute automatically when a user visits the affected page.

Recommendations Update WPeMatico RSS Feed Fetcher to a version newer than 2.8.17.

Exploitability

Fix

Impacts

Researchers

João Pedro S Alcântara

Kinorth

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers