CVE-2025-13031: medium-severity vulnerability in WPeMatico RSS Feed Fetcher
WPeMatico RSS Feed Fetcher < 2.8.13 - Contributor+ Stored XSS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.3%
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Affected products
Unknown · WPeMatico RSS Feed FetcherRelated CVEs — WPeMatico RSS Feed Fetcher
In the same product, most dangerous first.
CVE-2021-24793—WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2026-89006MEDIUMWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed ImportEPSS 0.2%CVE-2026-89005MEDIUMWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to CategoryEPSS 0.2%CVE-2026-89002MEDIUMWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item PreviewEPSS 0.2%CVE-2026-89004LOWWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOREPSS 0.2%CVE-2026-89001MEDIUMWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign SettingsEPSS 0.2%