{"id":"CVE-2026-120573","kind":"vulnerability","aliases":["CVE-2026-120573"],"related":[],"title":"WPeMatico RSS Feed Fetcher: contributor can plant script that runs for admins","description":"The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_category' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is persisted in post meta as campaign_data, bypassing wp_kses sanitization, and executes in the browser session of any user with edit_posts — including Administrators — who opens the WPeMatico campaigns list screen.","summary":"The WPeMatico RSS Feed Fetcher WordPress plugin up to and including 2.9.1 does not sanitize the post_category parameter. An authenticated contributor can store a script that runs in the browser of any editor or administrator who opens the WPeMatico campaigns list.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WPeMatico RSS Feed Fetcher","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","self-hosted","wordpress","wpematico"],"not_affected_if":["no-contributor-accounts","plugin-not-installed"],"how_to_check":"- Check the installed WPeMatico plugin version in the WordPress admin under Plugins; versions `2.9.1` and earlier are affected.\n- Review WPeMatico campaigns stored in post meta `campaign_data` for unexpected script content.","fix":null,"status":"open","published_at":"2026-11-13T10:17:26+00:00","first_seen_at":"2026-11-13T10:47:10+00:00","triaged_at":"2026-11-13T10:55:09+00:00","updated_at":"2026-11-13T10:55:09+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:55:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WPeMatico RSS Feed Fetcher: contributor can plant script that runs for admins","impact":"medium","summary":"The WPeMatico RSS Feed Fetcher WordPress plugin up to and including 2.9.1 does not sanitize the post_category parameter. An authenticated contributor can store a script that runs in the browser of any editor or administrator who opens the WPeMatico campaigns list.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpematico","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in administrator browser sessions, enabling account takeover","analyst_note":"Confirm the fixed version from the WordPress plugin page or NVD CPE ranges; the sources do not state one.","how_to_check":"- Check the installed WPeMatico plugin version in the WordPress admin under Plugins; versions `2.9.1` and earlier are affected.\n- Review WPeMatico campaigns stored in post meta `campaign_data` for unexpected script content.","plain_action":"","product_name":"WPeMatico RSS Feed Fetcher","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-contributor-accounts"],"who_is_affected":"Sites running the WPeMatico RSS Feed Fetcher plugin at version 2.9.1 or earlier where contributors or higher can create content. The attacker needs a contributor-level account, and the payload fires for users with edit_posts, including administrators who open the campaigns screen. Sites without the plugin, or with it updated past the affected range, can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000788,"input_tokens":4689,"output_tokens":638,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120573':15A,18A '-2026':14A,17A '2.9.1':40B,99C 'access':119C,135C 'admin':12A 'administr':64B,167C 'arbitrari':124C 'attack':114C 'authent':49B,113C 'browser':59B,158C 'bypass':150C 'campaign':69B,148C,172C 'categori':46B,90C 'contributor':5A,50B,117C 'contributor-level':116C 'cross':84C 'cross-sit':83C 'cve':13A,16A 'data':149C 'due':100C 'edit':164C 'editor':62B 'escap':107C 'execut':131C,155C 'feed':3A,21A,32B,74C 'fetcher':4A,22A,33B,75C 'host':26B 'includ':39B,98C,166C 'inject':123C,137C,140C 'input':103C 'insuffici':102C 'kses':152C 'level':118C 'list':70B,173C 'make':109C 'meta':146C 'open':66B,169C 'output':106C 'packag':23B 'page':128C,138C 'paramet':47B,91C 'payload':141C 'persist':143C 'plant':7A 'plugin':35B,76C 'possibl':111C 'post':45B,89C,145C,165C 'rss':2A,20A,31B,73C 'run':10A,56B 'sanit':43B,104C,153C 'screen':174C 'script':8A,54B,86C,126C 'self':25B 'self-host':24B 'session':159C 'site':85C 'store':52B,82C 'user':134C,162C 'version':94C 'via':87C 'vulner':80C 'web':125C 'whenev':132C 'wordpress':27B,34B,78C 'wp':151C 'wpematico':1A,19A,28B,30B,68B,72C,171C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPeMatico RSS Feed Fetcher plugin at version 2.9.1 or earlier where contributors or higher can create content. The attacker needs a contributor-level account, and the payload fires for users with edit_posts, including administrators who open the campaigns screen. Sites without the plugin, or with it updated past the affected range, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["rssfeedfetcher","wpematicorssfeedfetcher"],"ptokens":["feed","fetcher","rss","wpematico"],"labels":["medium","package","selfhosted","vendor","wordpress","wpematico"],"campaign_type":null,"search_a":"'-120573':15A,18A '-2026':14A,17A 'admin':12A 'contributor':5A 'cve':13A,16A 'feed':3A,21A 'fetcher':4A,22A 'plant':7A 'rss':2A,20A 'run':10A 'script':8A 'wpematico':1A,19A","search_b":"'2.9.1':40B 'administr':64B 'authent':49B 'browser':59B 'campaign':69B 'categori':46B 'contributor':50B 'editor':62B 'feed':32B 'fetcher':33B 'host':26B 'includ':39B 'list':70B 'open':66B 'packag':23B 'paramet':47B 'plugin':35B 'post':45B 'rss':31B 'run':56B 'sanit':43B 'script':54B 'self':25B 'self-host':24B 'store':52B 'wordpress':27B,34B 'wpematico':28B,30B,68B","search_c":"'2.9.1':99C 'access':119C,135C 'administr':167C 'arbitrari':124C 'attack':114C 'authent':113C 'browser':158C 'bypass':150C 'campaign':148C,172C 'categori':90C 'contributor':117C 'contributor-level':116C 'cross':84C 'cross-sit':83C 'data':149C 'due':100C 'edit':164C 'escap':107C 'execut':131C,155C 'feed':74C 'fetcher':75C 'includ':98C,166C 'inject':123C,137C,140C 'input':103C 'insuffici':102C 'kses':152C 'level':118C 'list':173C 'make':109C 'meta':146C 'open':169C 'output':106C 'page':128C,138C 'paramet':91C 'payload':141C 'persist':143C 'plugin':76C 'possibl':111C 'post':89C,145C,165C 'rss':73C 'sanit':104C,153C 'screen':174C 'script':86C,126C 'session':159C 'site':85C 'store':82C 'user':134C,162C 'version':94C 'via':87C 'vulner':80C 'web':125C 'whenev':132C 'wordpress':78C 'wp':151C 'wpematico':72C,171C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120573","severity":null,"published_at":"2026-11-13T10:17:26+00:00","modified_at":"2026-11-13T10:17:26+00:00","first_seen_at":"2026-11-13T10:47:10+00:00","fetched_at":"2026-11-13T10:47:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}