Medium severity · published Dec 9, 2025
CVE-2025-13031
WPeMatico RSS Feed Fetcher < 2.8.13 - Contributor+ Stored XSS
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.13 does not sanitize and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WR
WPeMatico RSS Feed Fetcher ·
before 2.8.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13031
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13031
wpscan.com
https://wpscan.com/vulnerability/9bf76fed-8f0a-4aef-8cf4-f6839c8f0a53/
More from WPeMatico RSS Feed Fetcher
6.8
CVE-2026-89006
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import
6.8
CVE-2026-89005
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category
6.8
CVE-2026-89002
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview
4.9
CVE-2026-89001
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings
4.1
CVE-2026-89003
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview