The vulnerability in the WPeMatico RSS Feed Fetcher plugin allows an unauthenticated attacker to store malicious scripts in imported RSS feed content. When a campaign's last editor has been granted the unfiltered_html capability, the plugin removes WordPress’s wp_filter_post_kses filter before inserting the feed item into the database, which results in the raw, entity‑decoded content being saved verbatim in the post_content field. When a site visitor views the compromised post, the embedded script executes in the visitor’s browser under the site’s domain. This stored cross‑site scripting flaw (CWE‑79) can be used to deface the site or influence client‑side behavior, but the CVE description does not specify further downstream impacts such as cookie theft or session hijacking.

Affected product: WPeMatico RSS Feed Fetcher by etruel, versions 2.9 and earlier. Sites running WordPress with this plugin, especially those that have campaigns saved by administrators who are automatically given the unfiltered_html capability, are vulnerable.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of less than 1% points to a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. An attacker can exploit the issue by publishing or compromising an RSS feed that a site administrator subscribes to; the plugin will then import the feed and store the injected content without sanitization. No special privileges are required, so the attack surface depends largely on the use of the plugin and the existence of an admin‑saved campaign with the unfiltered_html capability.