Etruel
Monthly
Privilege escalation in WPeMatico RSS Feed Fetcher (all versions through 2.8.24) allows any authenticated WordPress subscriber to gain full administrative access by invoking the unprotected wpematico_import_settings function. The missing capability check permits arbitrary WordPress site options to be overwritten, enabling attackers to enable user registration and set the default registration role to administrator - a two-stage takeover requiring only a valid subscriber account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack chain is low-complexity and directly actionable by any authenticated user.
Stored/reflected Cross-Site Scripting in the WPeMatico RSS Feed Fetcher WordPress plugin (versions 2.8.17 and earlier) allows unauthenticated remote attackers to inject malicious script that executes in the browser of a victim who interacts with crafted content. The CVSS:3.1 vector (AV:N/PR:N/UI:R/S:C) indicates network-reachable, no-authentication exploitation with a scope change, meaning injected script can affect the wider WordPress context beyond the vulnerable component. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Privilege escalation in WPeMatico RSS Feed Fetcher (all versions through 2.8.24) allows any authenticated WordPress subscriber to gain full administrative access by invoking the unprotected wpematico_import_settings function. The missing capability check permits arbitrary WordPress site options to be overwritten, enabling attackers to enable user registration and set the default registration role to administrator - a two-stage takeover requiring only a valid subscriber account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack chain is low-complexity and directly actionable by any authenticated user.
Stored/reflected Cross-Site Scripting in the WPeMatico RSS Feed Fetcher WordPress plugin (versions 2.8.17 and earlier) allows unauthenticated remote attackers to inject malicious script that executes in the browser of a victim who interacts with crafted content. The CVSS:3.1 vector (AV:N/PR:N/UI:R/S:C) indicates network-reachable, no-authentication exploitation with a scope change, meaning injected script can affect the wider WordPress context beyond the vulnerable component. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.