Vulnerabilities and security researches forwpematico wpematico
Direction: ascendingJun 07, 2024
WPeMatico RSS Feed Fetcher # CVE-2021-24793
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 01, 2021
- Research Description
- The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Affected versions
-
max 2.6.12.
- Status
-
vulnerable
Jul 26, 2025
WPeMatico RSS Feed Fetcher # CVE-2025-8103
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 26, 2025
- Research Description
- The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.7. This is due to missing nonce validation in the handle_feedback_submission() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected versions
-
max 2.8.8.
- Status
-
vulnerable
Nov 11, 2025
WPeMatico RSS Feed Fetcher # CVE-2025-49922
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 22, 2025
- Research Description
- Missing Authorization vulnerability in etruel WPeMatico RSS Feed Fetcher wpematico allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPeMatico RSS Feed Fetcher: from n/a through <= 2.8.3.
- Affected versions
-
max 2.8.4.
- Status
-
vulnerable
Dec 11, 2025
WPeMatico RSS Feed Fetcher # CVE-2025-13031
- CVE, Research URL
- Home page URL
- Application
- Date
- Dec 09, 2025
- Research Description
- The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Affected versions
-
max 2.8.13.
- Status
-
vulnerable
Apr 25, 2026
WPeMatico RSS Feed Fetcher # CVE-2025-57937
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 23, 2025
- Research Description
- Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in etruel WPeMatico RSS Feed Fetcher wpematico allows Retrieve Embedded Sensitive Data.This issue affects WPeMatico RSS Feed Fetcher: from n/a through <= 2.8.10.
- Affected versions
-
max 2.8.11.
- Status
-
vulnerable
Jun 14, 2026
WPeMatico RSS Feed Fetcher # CVE-2025-11917
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 05, 2025
- Research Description
- The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.11 via the wpematico_test_feed() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Affected versions
-
max 2.8.12.
- Status
-
vulnerable
Jul 04, 2026
WPeMatico RSS Feed Fetcher # CVE-2026-57349
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 02, 2026
- Research Description
- Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.
- Affected versions
-
max 2.8.18.
- Status
-
vulnerable
Aug 23, 2026
WPeMatico RSS Feed Fetcher # CVE-2026-19883
- CVE, Research URL
- Home page URL
- Application
- Date
- Aug 22, 2026
- Research Description
- The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematico_import_settings function in all versions up to, and including, 2.8.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access.
- Affected versions
-
max 2.8.25.
- Status
-
vulnerable
Sep 26, 2026
WPeMatico RSS Feed Fetcher # CVE-2026-89002
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 24, 2026
- Research Description
- The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign.
- Affected versions
-
max 2.8.26.
- Status
-
vulnerable
WPeMatico RSS Feed Fetcher # CVE-2026-89004
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 24, 2026
- Research Description
- The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators.
- Affected versions
-
max 2.8.26.
- Status
-
vulnerable
WPeMatico RSS Feed Fetcher # CVE-2026-89005
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 24, 2026
- Research Description
- The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session of any higher-privileged user who later views the campaign.
- Affected versions
-
max 2.8.26.
- Status
-
vulnerable
Sep 30, 2026
WPeMatico RSS Feed Fetcher # CVE-2026-89001
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 27, 2026
- Research Description
- The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user, including an administrator, as the post author.
- Affected versions
-
max 2.8.27.
- Status
-
vulnerable
WPeMatico RSS Feed Fetcher # CVE-2026-89003
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 27, 2026
- Research Description
- The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the responses back.
- Affected versions
-
max 2.8.27.
- Status
-
vulnerable
WPeMatico RSS Feed Fetcher # CVE-2026-89000
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 27, 2026
- Research Description
- The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only resources and read the responses back.
- Affected versions
-
max 2.8.27.
- Status
-
vulnerable
WPeMatico RSS Feed Fetcher # CVE-2026-89006
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 27, 2026
- Research Description
- The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
- Affected versions
-
max 2.8.27.
- Status
-
vulnerable