CVE-2026-89002 - WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview

Back Back to CVE browser

MEDIUM

WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview

Published Sep 24, 2026

6.8

MEDIUM

CVSS 3.1

EPSS 0.24%

Description

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign.

Affected products

Vendor n/a Product WPeMatico RSS Feed Fetcher Default
unaffected
Affected
- ≥ 0, < 2.8.26

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	WPeMatico RSS Feed Fetcher	unaffected	Affected ≥ 0, < 2.8.26

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85805
Advisory
https://wpscan.com/vulnerability/6820fac6-3238-4470-a865-677c4442f658/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85805		Advisory
https://wpscan.com/vulnerability/6820fac6-3238-4470-a865-677c4442f658/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Sep 24, 2026

Updated Sep 24, 2026

Reserved Sep 10, 2026

Link CVE-2026-89002

CISA Vulnrichment

Updated Sep 24, 2026

NVD

Status Received

Modified Sep 24, 2026

Link CVE-2026-89002

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Sep 24, 2026

Updated Sep 24, 2026

Link EUVD-2026-85805

GitHub

No data