The WPeMatico RSS Feed Fetcher WordPress plugin prior to version 2.8.26 does not properly sanitize and escape content fetched from user-supplied sources. This deficiency enables stored Cross-Site Scripting (CWE-79) attacks, where an attacker with contributor privileges can inject malicious scripts into campaign content. These scripts execute in the context of higher-privileged users who view the affected campaign, potentially leading to session hijacking, privilege escalation, or other malicious actions within the WordPress admin interface.

Attackers with contributor-level access can exploit this vulnerability to execute arbitrary JavaScript in the browsers of higher-privileged users who review the campaign content. This could lead to unauthorized actions performed with the privileges of the victim user, including but not limited to session hijacking or manipulation of site content.

Upgrade the WPeMatico RSS Feed Fetcher plugin to version 2.8.26 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory. Patch status is not explicitly stated but the presence of a fixed version implies an official fix is available.