What is the CVSS score of EUVD-2026-41348?

EUVD-2026-41348 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WPeMatico are affected by EUVD-2026-41348?

The WPeMatico RSS Feed Fetcher WordPress plugin (versions 2.8.17 and earlier) contains a stored/reflected cross-site scripting vulnerability allowing unauthenticated remote attackers to inject…

How to fix or mitigate EUVD-2026-41348?

Within 24 hours: Inventory all WordPress instances running WPeMatico plugin version 2.8.17 or earlier; disable the plugin immediately if identified; review server logs for XSS patterns and injection attempts. Within 7 days: Evaluate alternative RSS aggregation plugins with active security maintenance; document plugin removal or isolation approach for business stakeholders. Within 30 days: Complete migration to alternative solution or implement full compensating controls listed below; conduct post-incident review of any instances where plugin was active.

WPeMatico EUVD-2026-41348

| CVE-2026-57349 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-r6pv-mx9m-vf24

WordPress XSS Wordpress Plugin Wpematico Rss Feed Fetcher Etruel

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network XSS needing victim interaction (UI:R), with cross-context script execution (S:C) yielding limited C/I/A impact, matching a reflected/stored XSS profile.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:14 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.

AnalysisAI

Stored/reflected Cross-Site Scripting in the WPeMatico RSS Feed Fetcher WordPress plugin (versions 2.8.17 and earlier) allows unauthenticated remote attackers to inject malicious script that executes in the browser of a victim who interacts with crafted content. The CVSS:3.1 vector (AV:N/PR:N/UI:R/S:C) indicates network-reachable, no-authentication exploitation with a scope change, meaning injected script can affect the wider WordPress context beyond the vulnerable component. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

WPeMatico (vendor 'etruel', CPE cpe:2.3:a:etruel:wpematico_rss_feed_fetcher) is a WordPress auto-blogging plugin that fetches RSS/Atom feeds and imports their items into WordPress posts. The vulnerability is CWE-79 (Improper Neutralization of Input During Web Page Generation), the root class for Cross-Site Scripting, where attacker-controllable input is rendered into an HTML page without sufficient output encoding or input sanitization. Because RSS feed fetchers ingest and re-render remote, attacker-influenceable content (feed titles, item bodies, links), a common XSS vector is unsanitized feed data or unsanitized request parameters being echoed into an admin or public page. The scope change (S:C) in the CVSS vector is consistent with script from the plugin's component executing in the broader WordPress site security context.

RemediationAI

Update the WPeMatico RSS Feed Fetcher plugin to the version released after 2.8.17 (the fixed release above 2.8.17 per the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpematico/vulnerability/wordpress-wpematico-rss-feed-fetcher-plugin-2-8-17-cross-site-scripting-xss-vulnerability); no exact fixed version number was included in the provided data, so confirm the patched release directly from the vendor/Patchstack advisory before deploying. Because a released patched version is not independently confirmed here, treat this as: apply the vendor update as soon as the fixed version is verified. If immediate patching is not possible, compensating controls include placing a Web Application Firewall or virtual patch (Patchstack/Wordfence rules) in front of the site to filter XSS payloads, restricting access to the plugin's admin/settings pages to trusted IPs, and being cautious with untrusted RSS feed sources the plugin ingests; the trade-off is that WAF rules can be bypassed by novel encodings and IP restrictions do not stop payloads delivered through fetched feed content.