WPeMatico RSS Fetcher EUVD-2026-102798

Exploitation requires a specific chain: (1) a WordPress administrator must have created/saved a WPeMatico campaign, which causes the plugin to automatically set the unfiltered_html capability flag on that campaign's last editor; (2) that campaign must be subscribed to an RSS feed the attacker can publish to or compromise; and (3) a user must subsequently view the imported post for the stored script to execute. The core defect is that the plugin removes WordPress's wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post(), and stores $item->get_content() raw (only entity-decoded) in post_content. Limiting factors that reduce real-world risk: the attacker does not choose which feeds an admin subscribes to (AC:H), exploitation is confined to WPeMatico versions ≤2.9, and payload execution is passive/deferred until someone visits the injected post.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The NVD CVSS of 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) accurately captures the shape of the flaw: network-reachable and requiring no attacker authentication (PR:N), but with high attack complexity (AC:H) because exploitation depends on a chain of preconditions the attacker does not control - an administrator must already have configured a WPeMatico campaign (which auto-grants the unfiltered_html flag) and subscribed it to a feed the attacker can publish to or compromise. No EPSS score was supplied, the CVE is not on the CISA KEV list, and no public proof-of-concept was provided, so exploitation status is: no public exploit identified at time of analysis. The signals are internally consistent - a stored XSS with low individual impacts (C:L/I:L) and a scope change (S:C, reflecting execution in a visitor's browser context) legitimately lands in the medium band - and none of them (EPSS, KEV, POC) elevate it. The one nuance to verify is the AC:H versus PR:N interplay: the attacker is unauthenticated on the target, but success hinges entirely on a victim administrator's prior feed-subscription choice, so real-world exploitability is narrower than 'unauthenticated network XSS' sounds in isolation.

An attacker publishes (or compromises the server of) an RSS feed that a WordPress administrator has subscribed a WPeMatico campaign to, then seeds a feed item whose content contains a malicious <script> payload. Because the plugin strips WordPress's wp_filter_post_kses filter before inserting admin-saved campaign content, the raw script is stored verbatim in post_content and executes in the browser of anyone who later views the imported post. No public exploit code was identified, and the network vector is offset by high complexity (AC:H) since the attacker depends on the admin having already subscribed to the attacker-influenced feed.