Content Fetcher

Content Fetcher has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Content Fetcher has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

All of these findings were reported by Athiwat Tiprasaharn (Jitlada). Content Fetcher is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.6.7.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all Content Fetcher vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-49358

Content Fetcher <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Content Fetcher banner
Latestv1.1

Content Fetcher

Ruhul Amin

Author

Ruhul Amin

3.2(6)
64/100
Last Updated
2025-10-11 (11mo ago)
Active Installs
200+
Downloads
7,955
Requires WP
0+
Requires PHP
0+
Tested up to
WP 6.6.7
Created
2017-05-30 (9y ago)

This plugin allows users to fetch content from any website and display it effortlessly on their WordPress site using a simple shortcode. It’s perfect for adding external information, like news headlines, product details, or informative snippets, directly into posts or pages. Sample Shortcode: To fetch content from a Wikipedia page and display the infobox about Earth, use the following shortcode: Sample shortcode [get_content_from url=’https://en.wikipedia.org/wiki/Earth’ with=’.infobox’] Shortcode Attributes: url: The URL of the website from which you want to fetch content. with: A CSS selector that specifies which elements to fetch from the provided URL (e.g., .infobox for Wikipedia infoboxes). limit (optional): Limits the number of elements fetched and displayed. For example, limit=”3&#8243; will show only the first three matching elements. How It Works: After activating the plugin, simply use the [get_content_from] shortcode with your desired parameters. The plugin will automatically replace all URLs in images and links with absolute URLs to ensure they load correctly from the source website. This plugin is plug-and-play, requiring no additional setup—just add the shortcode to your content, and you’re ready to go! If you need to customize this plugin, you can checkout our WordPress Maintenance Services. Features: simple shortcode

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C