CVE-2021-24793

The WPeMatico RSS Feed Fetcher plugin versions prior to 2.6.12 contain a reflected cross-site scripting vulnerability in the Feed URL field of campaign settings. An authenticated user with elevated privileges can inject malicious code through the unescaped Feed URL parameter, which gets output directly into HTML attributes without proper sanitization. This allows attackers to execute arbitrary JavaScript in the context of other administrators' browsers, even in installations where the unfiltered_html capability has been restricted.

Based on public CVE data (MITRE/NVD).