CVE-2026-89002: WPeMatico RSS Feed Fetcher XSS Vulnerability

CVE-2026-89002 Overview

CVE-2026-89002 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin in versions prior to 2.8.26. The plugin fetches content from user-supplied RSS sources without sanitizing or escaping the retrieved data before rendering it in the WordPress admin interface. Low-privileged users such as contributors can configure a malicious feed source that injects script payloads into campaign content. When higher-privileged users such as editors or administrators review the campaign, the payload executes in their browser session. The vulnerability is tracked under CWE-79.

Critical Impact
An authenticated contributor can execute arbitrary JavaScript in the browser of an administrator reviewing a WPeMatico campaign, enabling account takeover of higher-privileged WordPress users.

Affected Products

WPeMatico RSS Feed Fetcher WordPress plugin, all versions before 2.8.26
WordPress installations where the plugin is active and contributor-level accounts exist
Multi-author WordPress sites that rely on editorial review of plugin-generated campaigns

Discovery Timeline

2026-09-24 - CVE CVE-2026-89002 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-89002

Vulnerability Analysis

The WPeMatico plugin fetches syndicated content from external RSS feeds specified by users with campaign-creation permissions. The plugin inserts the fetched feed content into the WordPress admin interface without applying output encoding or input sanitization. An attacker controlling the referenced feed, or an attacker who is a contributor on the WordPress site, can craft feed items containing HTML and JavaScript payloads. When an editor or administrator opens the campaign for review in wp-admin, the injected script executes in the context of the WordPress backend origin. Execution in the admin origin exposes nonces, session cookies, and privileged REST API endpoints, enabling the attacker to escalate privileges or persist malicious code site-wide.

Root Cause

The root cause is missing output encoding on data retrieved from an external, attacker-influenced source. WordPress provides helpers such as esc_html(), esc_attr(), and wp_kses_post() for safe rendering, but the vulnerable code paths render RSS-sourced strings directly into the DOM. This matches the CWE-79 pattern of improper neutralization of input during web page generation.

Attack Vector

Exploitation requires authenticated contributor-level access to the WordPress site and a victim user with higher privileges who reviews the campaign. The attacker creates or edits a WPeMatico campaign referencing a feed URL under their control. The feed returns items whose title, description, or content fields contain a payload such as an <img> or <svg> element with an inline event handler. When an administrator opens the campaign preview or edit screen, the browser parses the unsanitized HTML and executes the attacker's JavaScript. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-89002

Indicators of Compromise

WPeMatico campaigns referencing external feed URLs hosted on domains not associated with trusted content providers
Unexpected <script>, <svg>, or on* event-handler attributes stored in WPeMatico campaign records within the wp_posts or plugin-specific tables
New administrator accounts, modified user roles, or injected plugin files created shortly after a contributor edited a campaign
Outbound requests from administrator browsers to unfamiliar domains immediately after opening a campaign review page

Detection Strategies

Query the WordPress database for campaign content containing <script, onerror=, onload=, or javascript: substrings
Review WordPress audit logs for contributor accounts creating or modifying WPeMatico campaigns referencing external feeds
Monitor the installed plugin version and alert when WPeMatico is below 2.8.26

Monitoring Recommendations

Enable a WordPress activity log plugin to record campaign creation, edits, and feed URL changes with user attribution
Deploy a Content Security Policy (CSP) in report-only mode for wp-admin to surface inline script execution attempts
Forward web server and WordPress logs to a centralized analytics platform and alert on administrator sessions that trigger unusual outbound requests after accessing WPeMatico URIs

How to Mitigate CVE-2026-89002

Immediate Actions Required

Upgrade the WPeMatico RSS Feed Fetcher plugin to version 2.8.26 or later on all WordPress instances
Audit existing campaigns for untrusted feed sources and remove any entries containing HTML or script content in fetched items
Review contributor-level accounts and remove or restrict any that are no longer required
Rotate administrator credentials and WordPress authentication keys if campaign review activity by compromised contributors is suspected

Patch Information

The vendor addressed the issue in WPeMatico RSS Feed Fetcher version 2.8.26 by applying sanitization and escaping to feed-derived content before rendering. Refer to the WPScan Vulnerability Report for upgrade details.

Workarounds

Temporarily deactivate the WPeMatico plugin until the upgrade to 2.8.26 can be completed
Restrict campaign creation and editing to trusted editor or administrator roles by removing WPeMatico capabilities from contributors
Deploy a Web Application Firewall (WAF) rule that strips <script> tags and event-handler attributes from responses returned to wp-admin pages related to WPeMatico

bash

# Configuration example: enforce plugin update via WP-CLI
wp plugin update wpematico --version=2.8.26
wp plugin status wpematico