CVE-2026-89006

Deferred Deferred - Pending Action

Stored XSS in WPeMatico RSS Feed Fetcher WordPress Plugin

Publication date: 2026-09-27

Last updated on: 2026-09-28

Assigner: WPScan

Description

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-27

Last Modified

2026-09-28

Generated

2026-10-17

AI Q&A

2026-09-27

EPSS Evaluated

2026-10-16

NVD

CVE-2026-89006

EUVD

EUVD-2026-87895

Affected Vendors & Products

Vendor	Product	Version / Range
wpeconomics	wpeematico_rss_feed_fetcher	to 2.8.27 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The WPeMatico RSS Feed Fetcher WordPress plugin before version 2.8.27 has a flaw where imported feed content is not properly sanitized before being stored as post content. This allows users with the Contributor role or higher to inject malicious scripts, enabling Stored Cross-Site Scripting (XSS) attacks.

Detection Guidance

Check the installed version of the WPeMatico RSS Feed Fetcher plugin. If it is below 2.8.27, the system is vulnerable. Use WordPress admin panel or run: wp plugin list | grep wpeematico_rss_feed_fetcher in the WordPress directory.

Impact Analysis

This vulnerability allows attackers with Contributor access or higher to inject malicious scripts into your WordPress site. These scripts can steal user data, hijack sessions, or deface your website. Visitors may unknowingly execute harmful scripts when viewing affected posts.

Compliance Impact

This XSS vulnerability could lead to data breaches, exposing user data and violating GDPR or HIPAA requirements for data protection. Non-compliance may result in legal penalties, reputational damage, and loss of trust from users.

Mitigation Strategies

Update the WPeMatico RSS Feed Fetcher plugin to version 2.8.27 or later immediately. Remove or disable the plugin if an update is not available. Review posts created by Contributors for suspicious scripts.

Hi! I’m here to help you understand CVE-2026-89006. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70