WPeMatico Feed Fetcher EUVD-2026-87895

Requires an authenticated WordPress user with the Contributor role or higher on a site running WPeMatico RSS Feed Fetcher before 2.8.27, plus the ability to influence imported feed content (feed source configuration containing script). Exploitation is not automatic: a victim (typically an editor or administrator, or any site visitor) must render the post containing the stored payload for the script to fire (UI:R). Limiting factors: it is not remote-unauthenticated - a low-privilege account is a prerequisite - and it depends on the plugin's unsanitized feed-import-to-post-content path. Sites that restrict Contributor accounts or run 2.8.27+ are not exposed.

This is a genuine but low-urgency issue. The signals are consistent in pointing to limited real-world risk despite a moderate CVSS of 6.8: EPSS is very low (0.15%, 4th percentile), it is NOT in CISA KEV, and SSVC records Exploitation as 'none' and Automatable as 'no' - meaning no observed exploitation and no reliable automation. A public POC exists (WPScan), so exploit knowledge is available, but POC availability is distinct from active exploitation. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) appears internally inconsistent: the description states exploitation requires only the Contributor role 'and above', which is a low-privilege authenticated role, so PR:H overstates the requirement (PR:L is more accurate). Likewise, a stored XSS executes in a victim's browser in a different security context, which normally warrants S:C with C:L/I:L rather than S:U with full C:H/I:H/A:H - the vendor scoring likely inflates the impact metrics. SSVC 'Technical Impact: total' is a common overstatement for XSS. Net: a real, patched vulnerability requiring an authenticated low-privilege user plus victim interaction - a defensible medium-severity finding, not a high-priority emergency.

An attacker who holds (or obtains) a Contributor account on a WordPress site running WPeMatico configures or influences an RSS feed source so imported feed items contain a malicious <script> payload. Because the plugin stores imported feed content as post content without sanitization, the script is persisted and later executes in the browser of anyone viewing the post - including higher-privilege editors or administrators, enabling session/cookie theft or admin action forgery. A public POC is available via WPScan, lowering the effort to reproduce.