Vulnerabilities

TI-2026-60322 CVE-2026-89006 · GHSA-f35c-fj5h-9hj5

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import

LOW 31

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scr…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00229 Published 2026-09-27 Fixed in 2.8.27 CWE-79

TI-2026-60319 CVE-2026-89003 · GHSA-jghr-cfvc-958g

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview

LOW 18

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to…

CVSS 3.1MEDIUM 4.1 Network High privileges No interaction EPSS 0.00174 Published 2026-09-27 Fixed in 2.8.27 CWE-918

TI-2026-60317 CVE-2026-89001 · GHSA-m259-ww4h-6j9q

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings

LOW 22

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00188 Published 2026-09-27 Fixed in 2.8.27 CWE-269

TI-2026-60316 CVE-2026-89000 · GHSA-x8xr-q2j9-gfc2

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run