CVE-2026-89006: WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import
Published Sep 27, 2026
·Updated
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Software
1 affected component
WPeMatico RSS Feed Fetcher WordPress plugin<2.8.27
Event History
Sep 27, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A user with the WordPress Contributor role or any higher-privileged role can exploit it by importing feed content containing malicious script payloads.
2
How can I determine whether my site is affected?
Your site is affected if it uses the WPeMatico RSS Feed Fetcher WordPress plugin at a version earlier than 2.8.27 and Contributor-or-higher users can import feeds.
3
What is the immediate mitigation if updating is not possible?
Restrict feed-import capability to trusted administrators and remove or suspend untrusted Contributor and higher-privileged accounts that could import attacker-controlled feed content.