# CVE-2026-89006: WPeMatico RSS Feed Fetcher stored XSS in feed import

Source: https://junglewise.ai/threats/cve-2026-89006-the-wpematico-rss-feed-fetcher-wordpress-plugin-before-2-8-27  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-89006 · Severity: info · Published 2026-09-27

WPeMatico is a WordPress plugin that imports content from RSS feeds into blog posts. The plugin before version 2.8.27 fails to clean malicious code from imported feed content, allowing users with Contributor privileges or higher to inject stored cross-site scripting attacks that execute in the browsers of site visitors and administrators.

Technologies: [WPeMatico RSS Feed Fetcher](https://junglewise.ai/threats/technologies/wpematico-wpematico-rss-feed-fetcher). Vendors: [WPeMatico](https://junglewise.ai/threats/vendors/wpematico).

## Quick answers

**Is CVE-2026-89006 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89006 being exploited in the wild.

**How severe is CVE-2026-89006?** Informational severity, published 27 September 2026.

**Which products and versions are affected?** WPeMatico RSS Feed Fetcher before 2.8.27.

**Is there a fix for CVE-2026-89006?** A patch was published on 2026-09-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89006 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-89006?** Check whether you run WPeMatico RSS Feed Fetcher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin does not sanitize imported feed content before storing it as post content, enabling Stored XSS via CWE-79. The vulnerability requires authentication as a Contributor role or above and is exploitable by crafting malicious RSS feeds. An attacker can inject arbitrary JavaScript that persists in the database and executes in the browsers of all users viewing the affected posts.

## Affected products

- WPeMatico WPeMatico RSS Feed Fetcher before 2.8.27

## Timeline

- 2026-09-25: disclosed
- 2026-09-27: patched

## References

- [https://wpscan.com/vulnerability/680091de-610a-4665-a028-515ca6c33055/](https://wpscan.com/vulnerability/680091de-610a-4665-a028-515ca6c33055/)

## Related threats

- [WPeMatico RSS Feed Fetcher SSRF in campaign preview](https://junglewise.ai/threats/cve-2026-89003-the-wpematico-rss-feed-fetcher-wordpress-plugin-before-2-8-27)
- [WPeMatico RSS Feed Fetcher privilege escalation in campaign settings](https://junglewise.ai/threats/cve-2026-89001-the-wpematico-rss-feed-fetcher-wordpress-plugin-before-2-8-27)
- [WPeMatico RSS Feed Fetcher SSRF in campaign run](https://junglewise.ai/threats/cve-2026-89000-the-wpematico-rss-feed-fetcher-wordpress-plugin-before-2-8-27)