CVE-2026-89006
Received Received - Intake

Stored XSS in WPeMatico RSS Feed Fetcher WordPress Plugin

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: WPScan

Description
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-89006
EUVD
EUVD-2026-87895

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpeconomics wpeematico_rss_feed_fetcher to 2.8.27 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WPeMatico RSS Feed Fetcher WordPress plugin before version 2.8.27 has a flaw where imported feed content is not properly sanitized before being stored as post content. This allows users with the Contributor role or higher to inject malicious scripts, enabling Stored Cross-Site Scripting (XSS) attacks.

Detection Guidance

Check the installed version of the WPeMatico RSS Feed Fetcher plugin. If it is below 2.8.27, the system is vulnerable. Use WordPress admin panel or run: wp plugin list | grep wpeematico_rss_feed_fetcher in the WordPress directory.

Impact Analysis

This vulnerability allows attackers with Contributor access or higher to inject malicious scripts into your WordPress site. These scripts can steal user data, hijack sessions, or deface your website. Visitors may unknowingly execute harmful scripts when viewing affected posts.

Compliance Impact

This XSS vulnerability could lead to data breaches, exposing user data and violating GDPR or HIPAA requirements for data protection. Non-compliance may result in legal penalties, reputational damage, and loss of trust from users.

Mitigation Strategies

Update the WPeMatico RSS Feed Fetcher plugin to version 2.8.27 or later immediately. Remove or disable the plugin if an update is not available. Review posts created by Contributors for suspicious scripts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89006. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart