Stored XSS in WPeMatico RSS Feed Fetcher WordPress Plugin

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin before version 2.8.26. It occurs when a specific campaign configuration field is not properly sanitized or escaped, allowing users with Contributor role or higher to inject malicious scripts. These scripts are stored and executed when a higher-privileged user views the affected campaign.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the WPeMatico RSS Feed Fetcher plugin. If it is below 2.8.26, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Contributor access or higher could inject malicious scripts into your WordPress site. When an admin or other privileged user views the compromised campaign, the script executes in their session, potentially leading to unauthorized actions, data theft, or further compromise of your site.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information security). Stored XSS attacks can expose sensitive user data, resulting in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WPeMatico RSS Feed Fetcher plugin to version 2.8.26 or later immediately. Remove or restrict access for users with the Contributor role until the update is applied to prevent potential exploitation.

Useful 0 Not Useful 0