CVE-2026-89006 - WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import

Back Back to CVE browser

MEDIUM

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import

Published Sep 27, 2026

6.8

MEDIUM

CVSS 3.1

EPSS 0.24%

Description

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Affected products

Vendor n/a Product WPeMatico RSS Feed Fetcher Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.8.27

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

WPeMatico RSS Feed Fetcher

unaffected

Version	Status	Constraints
0	affected	<2.8.27

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87895
Advisory
https://wpscan.com/vulnerability/680091de-610a-4665-a028-515ca6c33055/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87895		Advisory
https://wpscan.com/vulnerability/680091de-610a-4665-a028-515ca6c33055/		exploitvdb-entrytechnical-description