Medium severity · published Sep 27, 2026
CVE-2026-89006
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WR
WPeMatico RSS Feed Fetcher ·
before 2.8.27 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89006
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-89006
exploit
https://wpscan.com/vulnerability/680091de-610a-4665-a028-515ca6c33055/
More from WPeMatico RSS Feed Fetcher
6.8
CVE-2026-89005
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category
6.8
CVE-2026-89002
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview
5.9
CVE-2025-13031
WPeMatico RSS Feed Fetcher < 2.8.13 - Contributor+ Stored XSS
4.9
CVE-2026-89001
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings
4.1
CVE-2026-89003
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview