WPeMatico RSS Fetcher EUVD-2026-85807

Requires an authenticated WordPress account with Contributor role or higher on a site running WPeMatico RSS Feed Fetcher before 2.8.26, AND the specific (unnamed) plugin feature that exposes the vulnerable campaign-configuration field must be enabled (a non-default condition). Exploitation is not self-contained: a higher-privileged user (Editor/Administrator) must subsequently view the attacker's campaign in wp-admin for the stored payload to execute (UI:R). These gates - authenticated low-privilege access, a feature toggle, and required victim interaction - meaningfully limit real-world exploitability despite the network attack vector.

This is a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, 6.8) reflects WPScan's convention of scoring admin-session stored XSS at full C:H/I:H/A:H because script running in an administrator's browser can effectively hijack the site - but the exploitation gates are significant: an attacker needs an authenticated account (the description says Contributor role and above), the vulnerable campaign-configuration field is only reachable 'when a certain feature is enabled' (non-default condition), and a higher-privileged user must later view the malicious campaign (UI:R). SSVC corroborates a low operational priority: Exploitation=none (no observed exploitation) and Automatable=no, even though Technical Impact=total. EPSS and KEV are absent from the input, and there is no evidence of active exploitation. A public PoC exists (WPScan) and a vendor patch is available (2.8.26), so the gap defenders must close is clear, but the combination of required authentication, a non-default feature, and required victim interaction places this well below internet-facing unauthenticated flaws. Note a metric tension: the description says 'Contributor role and above,' which usually maps to PR:L, whereas the supplied vector uses PR:H - verify the true minimum privilege with the WPScan advisory, as PR:L would raise the score.

A low-privileged Contributor on a multi-author WordPress site running WPeMatico with the relevant campaign feature enabled saves a crafted payload into the unsanitized campaign-configuration field. When an editor or administrator later opens that campaign in wp-admin, the stored script executes in their authenticated session, allowing session/nonce theft, creation of rogue admin accounts, or content manipulation. A public PoC is available via WPScan, lowering the effort to reproduce.