Skip to content
fr Sign in
Not rated

CVE-2021-24793 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before…

Description

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Affected products and versions

Product Affected versions Fixed in
WPeMatico RSS Feed Fetcher 2.6 earliest → < 2.6.12 2.6.12

References

Timeline

  1. Published
  2. Last modified

Other CVEs of WPeMatico RSS Feed Fetcher

The 9 CVEs of WPeMatico RSS Feed Fetcher →
CVE-2026-89001 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is… 4.9 Medium CVE-2026-89006 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing… 6.8 Medium CVE-2026-89003 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a… 4.1 Medium CVE-2026-89000 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the… 4.1 Medium
Track this CVE