CVE-2025-13031: falha de média gravidade em WPeMatico RSS Feed Fetcher
WPeMatico RSS Feed Fetcher < 2.8.13 - Contributor+ Stored XSS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.9epss 0.3%
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Produtos afetados
Unknown · WPeMatico RSS Feed FetcherCVEs relacionadas — WPeMatico RSS Feed Fetcher
No mesmo produto, das mais perigosas para as menos.
CVE-2021-24793—WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2026-89006MEDIUMWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed ImportEPSS 0.2%CVE-2026-89005MEDIUMWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to CategoryEPSS 0.2%CVE-2026-89002MEDIUMWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item PreviewEPSS 0.2%CVE-2026-89004LOWWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOREPSS 0.2%CVE-2026-89001MEDIUMWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign SettingsEPSS 0.2%