CVE-2021-24793

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24793 WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24793

CVE-2021-24793 references the WPeMatico RSS Feed Fetcher WordPress plugin, before version 2.6.12, which does not escape the feed URL added to a campaign before outputting it in an attribute. This enables stored Cross‑Site Scripting (XSS) when exploited by high‑privilege users, even when unfiltere...