CVE-2026-110252

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress's wpfilterpostkses filter from contentsavepre immediately before calling wpinsertpost with RSS feed content, whenever...

CVE-2026-110252 WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress's wpfilterpostkses filter from contentsavepre immediately before calling wpinsertpost with RSS feed content, whenever...

CVE-2026-110252

The WPeMatico RSS Feed Fetcher plugin for WordPress (versions up to and including 2.9 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is the plugin's removal of the wp_filter_post_kses filter from content_save_pre before calling wp_insert_post() with RSS feed...

EUVD-2024-16580

Malicious code in bioql PyPI...

CVE-2024-0792 WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping on RSS feed content. This makes it possible for...

CVE-2024-0792: Improper Neutralization of Input During Web Page Generation

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping on RSS feed content. This makes it possible for...

PT-2024-15824

Name of the Vulnerable Software and Affected Versions WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress versions up to, and including, 7.0.1 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on RSS feed content...