CVE-2026-57349

The WPeMatico RSS Feed Fetcher plugin versions up to 2.8.17 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can inject malicious script without authentication.

Risk includes session hijacking, redirection to malicious sites, and theft of sensitive data. The attack can be performed remotely without authentication.

Immediately update the WPeMatico RSS Feed Fetcher plugin to the latest available version. Consider deploying Web Application Firewalls (WAF) to block XSS attacks.