CVE-2026-89006

UNKNOWN 0.0

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

Vendor	unknown
Product	wpematico rss feed fetcher
Published	Sep 27, 2026

Stay Ahead of the Next One

Get instant alerts for unknown wpematico rss feed fetcher

Be the first to know when new unknown vulnerabilities affecting unknown wpematico rss feed fetcher are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / WPeMatico RSS Feed Fetcher

0 < 2.8.27

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/680091de-610a-4665-a028-515ca6c33055/

Credits

Philipp Doblhofer WPScan