CVE-2026-89005: CWE-79 Cross-Site Scripting (XSS) in WPeMatico RSS Feed Fetcher
A stored cross-site scripting (XSS) vulnerability exists in the WPeMatico RSS Feed Fetcher WordPress plugin versions before 2.8.26. This flaw occurs because one of the campaign configuration fields is not properly sanitized or escaped when a specific feature is enabled. Users with Contributor role or higher can exploit this to inject malicious scripts that execute in the browsers of higher-privileged users who view the affected campaign.
AI Analysis
Technical Summary
The WPeMatico RSS Feed Fetcher WordPress plugin prior to version 2.8.26 contains a stored XSS vulnerability (CWE-79) due to improper sanitization and escaping of a campaign configuration field when a certain feature is enabled. This allows users with Contributor role and above to inject malicious scripts that execute in the session context of any higher-privileged user who later views the campaign, potentially leading to session hijacking or other attacks within the WordPress admin interface.
Potential Impact
An attacker with Contributor or higher privileges can inject persistent malicious scripts that execute in the browsers of higher-privileged users (e.g., Editors, Administrators) when they view the affected campaign. This can lead to session hijacking, privilege escalation, or other malicious actions within the WordPress environment. The vulnerability requires at least Contributor-level access, so it does not allow unauthenticated exploitation.
Mitigation Recommendations
Upgrade the WPeMatico RSS Feed Fetcher plugin to version 2.8.26 or later where this vulnerability is fixed. Since the plugin version 2.8.26 addresses this issue, applying this official fix is the recommended remediation. No other mitigations are specified.
CVE-2026-89005: CWE-79 Cross-Site Scripting (XSS) in WPeMatico RSS Feed Fetcher
Description
A stored cross-site scripting (XSS) vulnerability exists in the WPeMatico RSS Feed Fetcher WordPress plugin versions before 2.8.26. This flaw occurs because one of the campaign configuration fields is not properly sanitized or escaped when a specific feature is enabled. Users with Contributor role or higher can exploit this to inject malicious scripts that execute in the browsers of higher-privileged users who view the affected campaign.
Affected software
WPeMatico RSS Feed Fetcher
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WPeMatico RSS Feed Fetcher WordPress plugin prior to version 2.8.26 contains a stored XSS vulnerability (CWE-79) due to improper sanitization and escaping of a campaign configuration field when a certain feature is enabled. This allows users with Contributor role and above to inject malicious scripts that execute in the session context of any higher-privileged user who later views the campaign, potentially leading to session hijacking or other attacks within the WordPress admin interface.
Potential Impact
An attacker with Contributor or higher privileges can inject persistent malicious scripts that execute in the browsers of higher-privileged users (e.g., Editors, Administrators) when they view the affected campaign. This can lead to session hijacking, privilege escalation, or other malicious actions within the WordPress environment. The vulnerability requires at least Contributor-level access, so it does not allow unauthenticated exploitation.
Mitigation Recommendations
Upgrade the WPeMatico RSS Feed Fetcher plugin to version 2.8.26 or later where this vulnerability is fixed. Since the plugin version 2.8.26 addresses this issue, applying this official fix is the recommended remediation. No other mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-10T16:19:35.685Z
- State
- PUBLISHED
Threat ID: 6ab4c0b5f7a7c54106f3a847
Added to database: 09/24/2026, 06:18:29 UTC
Last enriched: 09/24/2026, 06:33:20 UTC
Last updated: 09/24/2026, 07:25:19 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.