WPeMatico RSS Feed Fetcher EUVD-2026-85805

Requires an authenticated WordPress account with at least contributor-level privileges on a site running WPeMatico RSS Feed Fetcher before 2.8.26; the attacker must create/control a fetch campaign whose retrieved feed content includes the XSS payload. Exploitation is gated by user interaction (UI:R): a higher-privileged user (editor/administrator) must open and review the campaign in wp-admin for the stored script to fire. It is not automatable (SSVC Automatable=no) and does not affect default single-admin installs where no untrusted contributors exist - the multi-author/editorial deployment model is the key limiting factor.

This is a genuine but conditional risk rather than a drop-everything priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H = 6.8) is internally inconsistent with the description: it sets PR:H, yet the description explicitly states the attacker is a low-privileged 'contributor', which corresponds to PR:L - this discrepancy should be verified with WPScan. The C:H/I:H/A:H impact reflects WPScan's convention of scoring admin-targeting stored XSS as full compromise (a hijacked admin session can lead to plugin/theme editing and site takeover), but note S:U conflicts with the fact that the payload executes in a higher-privileged victim's context, which arguably warrants S:C. SSVC tempers the picture: Exploitation=none (no observed exploitation) and Automatable=no (requires an admin/editor to manually review the malicious campaign), even though Technical Impact=total. EPSS and KEV are both absent - there is no evidence of active exploitation, so this is NOT a widespread-exploitation scenario. A public PoC exists (WPScan) and a vendor patch is available, so the practical posture is: real, exploitable, and patchable, but gated behind contributor-level access plus required admin interaction, making it a moderate priority best resolved by updating to 2.8.26.

A contributor-level user on a multi-author WordPress site configures a WPeMatico RSS fetch campaign whose feed content contains an unsanitized XSS payload; when an administrator or editor later reviews that campaign in wp-admin, the script executes in their authenticated session. Because a public PoC is available (WPScan) and the vector is network-based with low complexity, the payload can perform actions as the reviewing admin (e.g., create a rogue admin or inject persistent code). Exploitation still requires the victim to open/review the campaign (UI:R) and the attacker to hold a contributor account.