Unknown Wpematico Rss Feed Fetcher vulnerabilities

8 CVEs affecting Unknown Wpematico Rss Feed Fetcher, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-89006, published 2026-09-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-13031, published 2025-12-09. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored…
CVE-2026-89006, published 2026-09-27. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform…
CVE-2026-89005, published 2026-09-24. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the…
CVE-2026-89002, published 2026-09-24. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as…
CVE-2026-89004, published 2026-09-24. Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days. The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with…
CVE-2026-89001, published 2026-09-27. Medium severity, CVSS 4.9. EPSS: 0.2% chance of exploitation in the next 30 days. The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing…
CVE-2026-89003, published 2026-09-27. Medium severity, CVSS 4.1. EPSS: 0.2% chance of exploitation in the next 30 days. The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level…
CVE-2026-89000, published 2026-09-27. Medium severity, CVSS 4.1. EPSS: 0.2% chance of exploitation in the next 30 days. The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing…