Vulnerability · Published Sep 24, 2026 · Assigned by WPScan

CVE-2026-89005WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category

Medium 6.8

In plain English

A medium-severity cross-site scripting in WPeMatico RSS Feed Fetcher from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.2%top 86.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session of any higher-privileged user who later views the campaign.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WPeMatico RSS Feed Fetcher	0 – before 2.8.26

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/1c6f4da0-d7e8-4f50-851f-f794552db985/ exploit, vdb-entry, technical-description