Vulnerability Research Plan: CVE-2026-57349

1. Vulnerability Summary

The WPeMatico RSS Feed Fetcher plugin (versions <= 2.8.17) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS). The vulnerability exists in the plugin's "Feed Viewer" tool, which is part of the debug/tools suite.

Specifically, the plugin fails to sanitize or escape HTTP headers and URL information returned when fetching a feed link. This data is then rendered into the WordPress admin dashboard via an AJAX response using the dangerous .html() jQuery method. While the tool is located in the admin area, an attacker can leverage a specialized JavaScript component (app/js/tools_page.js) that automatically triggers a feed fetch based on a URL parameter (feedlink), effectively allowing an unauthenticated attacker to inject scripts into the admin's session via a malicious external RSS feed.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: wp_ajax_wpematico_get_feed_file (handled by wpematico_feed_viewer)
• Vulnerable Parameter: url (in the POST request) and the subsequent HTTP headers returned by that URL.
• Trigger Parameter: feedlink (in the GET request to the tools page).
• Authentication: The attacker is unauthenticated; however, the script executes when a logged-in Administrator