Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: WPeMatico RSS Feed Fetcher 2.8.26 Clear all filters
TI-2026-60321 CVE-2026-89005 · GHSA-gw77-m839-mhwc

WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category

Priority LOW 31

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and abov…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00229 Published 2026-09-24 Fixed in 2.8.26 CWE-79
TI-2026-60320 CVE-2026-89004 · GHSA-vg6c-rr97-8gp5

WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR

Priority LOW 13

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and ab…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00216 Published 2026-09-24 Fixed in 2.8.26 CWE-639
TI-2026-60318 CVE-2026-89002 · GHSA-r5xh-cv7p-cchm

WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview

Priority LOW 31

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Sto…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00229 Published 2026-09-24 Fixed in 2.8.26 CWE-79