CVE-2026-110252: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etruel WPeMatico RSS Feed Fetcher

CVE-2026-110252 is a stored cross-site scripting vulnerability in the WPeMatico RSS Feed Fetcher plugin for WordPress, affecting versions up to 2.9. The vulnerability arises because the plugin removes the wp_filter_post_kses filter from content_save_pre before calling wp_insert_post() with RSS feed content. This happens when the campaign's last editor has the unfiltered_html capability, which the plugin automatically assigns to every admin-saved campaign. As a result, imported RSS feed content is stored verbatim without proper sanitization, allowing unauthenticated attackers who control or compromise an RSS feed subscribed by an administrator to inject arbitrary scripts that execute in users' browsers when viewing the affected posts.

An attacker who controls or compromises an RSS feed subscribed to by an administrator can inject malicious scripts into posts created by the plugin. These scripts execute in the context of users viewing the posts, potentially leading to session hijacking, defacement, or other script-based attacks. The vulnerability requires the attacker to control the RSS feed and for an administrator to have subscribed to it, but no authentication is required for the attacker. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity.

No official patch or fix is currently documented. Users should avoid subscribing to untrusted or unverified RSS feeds in WPeMatico campaigns. Administrators should monitor for suspicious imported content and consider disabling or limiting the plugin until a fix is available. Check the vendor's advisory or plugin updates regularly for official remediation. Since no patch is confirmed, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.