https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 21:36:57 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-110252 <p>The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress&#39;s wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() with RSS feed content, whenever the campaign&#39;s last editor had the unfiltered_html capability — a flag the plugin sets automatically for every admin-saved campaign. Imported item content is taken raw from $item-&gt;get_content(), only entity-decoded, and stored verbatim in post_content. This makes it possible for unauthenticated attackers, who publish or compromise an RSS feed that an administrator has subscribed a WPeMatico campaign to, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected imported post.</p> <p>The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress&#39;s wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() with RSS feed content, whenever the campaign&#39;s last editor had the unfiltered_html capability — a flag the plugin sets automatically for every admin-saved campaign. Imported item content is taken raw from $item-&gt;get_content(), only entity-decoded, and stored verbatim in post_content. This makes it possible for unauthenticated attackers, who publish or compromise an RSS feed that an administrator has subscribed a WPeMatico campaign to, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected imported post.</p> https://db.gcve.eu/vuln/fkie_cve-2026-110252 https://db.gcve.eu/vuln/ghsa-gjv3-f2fr-pfqr <p>The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress&#39;s wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() with RSS feed content, whenever the campaign&#39;s last editor had the unfiltered_html capability — a flag the plugin sets automatically for every admin-saved campaign. Imported item content is taken raw from $item-&gt;get_content(), only entity-decoded, and stored verbatim in post_content. This makes it possible for unauthenticated attackers, who publish or compromise an RSS feed that an administrator has subscribed a WPeMatico campaign to, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected imported post.</p> <p>The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress&#39;s wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() with RSS feed content, whenever the campaign&#39;s last editor had the unfiltered_html capability — a flag the plugin sets automatically for every admin-saved campaign. Imported item content is taken raw from $item-&gt;get_content(), only entity-decoded, and stored verbatim in post_content. This makes it possible for unauthenticated attackers, who publish or compromise an RSS feed that an administrator has subscribed a WPeMatico campaign to, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected imported post.</p> https://db.gcve.eu/vuln/ghsa-gjv3-f2fr-pfqr