CVE-2026-89002
Received Received - Intake

Stored XSS in WPeMatico RSS Feed Fetcher WordPress Plugin

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: WPScan

Description
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-89002
EUVD
EUVD-2026-85805

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpmatico wpmatico to 2.8.26 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the WPeMatico RSS Feed Fetcher WordPress plugin before version 2.8.26. It allows users with contributor-level access or higher to inject malicious scripts into campaign item previews. The plugin fails to sanitize or escape user-supplied content before rendering it, which can lead to script execution when higher-privileged users review the campaign.

Detection Guidance

Check WordPress plugin versions using WP-CLI with 'wp plugin list' and compare against version 2.8.26. Inspect campaign previews in WPeMatico for unexpected scripts in HTML source. Look for unusual user-generated content in feeds.

Impact Analysis

This vulnerability could allow attackers with contributor access to inject malicious scripts into WordPress campaigns. When higher-privileged users view these campaigns, the scripts execute, potentially stealing sensitive data, session cookies, or performing unauthorized actions on their behalf. It compromises the security of the WordPress site and its users.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR and HIPAA compliance requirements. GDPR mandates strict data protection and breach notification, while HIPAA requires safeguarding protected health information. A successful exploit could result in unauthorized access to sensitive data, leading to legal and financial penalties.

Mitigation Strategies

Update the WPeMatico plugin to version 2.8.26 or later immediately. Review contributor-level users for suspicious activity. Disable the plugin temporarily if an update is not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89002. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart