CVE-2021-24793 | BDVDB-2026-163539 Detail

WPeMatico RSS Feed Fetcher

Description#

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://wpscan.com/vulnerability/eeedbb3b-ae10-4472-a1d3-f196f95b9d96

Exploit#

No public exploit known

History#

Version 12021-11-01Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.