CVE-2026-89002 Overview
CVE-2026-89002 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin in versions prior to 2.8.26. The plugin fetches content from user-supplied RSS feed sources and renders it without proper sanitization or output escaping. Contributor-level users can configure a campaign that pulls attacker-controlled feed content containing malicious JavaScript. When higher-privileged users such as editors or administrators review the campaign in the WordPress dashboard, the payload executes in their browser session. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
A contributor account can pivot to administrator-level actions by executing arbitrary JavaScript in a reviewer's authenticated session, enabling account takeover and site compromise.
Affected Products
- WPeMatico RSS Feed Fetcher WordPress plugin versions before 2.8.26
- WordPress installations with contributor or higher-role user accounts able to create feed campaigns
- Sites where administrators or editors review contributor-authored campaigns in the admin dashboard
Discovery Timeline
- 2026-09-24 - CVE-2026-89002 published to NVD
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-89002
Vulnerability Analysis
The WPeMatico plugin retrieves external RSS feed data and displays campaign preview and item content within the WordPress admin interface. The retrieved content is rendered without applying WordPress sanitization functions such as wp_kses_post() or output escaping via esc_html() and esc_attr(). Because the source of the feed is user-controlled at campaign creation time, a low-privileged contributor can point a campaign at a feed that returns crafted HTML and JavaScript. The stored payload persists in the campaign record and executes when reviewers open the campaign page.
The vulnerability is classified under CWE-79 and requires authenticated access with contributor privileges plus user interaction from a higher-privileged reviewer.
Root Cause
The root cause is missing input sanitization and output escaping of externally fetched RSS feed content before rendering it in the WordPress admin UI. The plugin treats the third-party feed as trusted data, but the feed URL is chosen by an authenticated but low-privileged user. This trust boundary violation allows attacker-controlled markup to reach the DOM of an administrator's session.
Attack Vector
An attacker with contributor access creates a WPeMatico campaign that points to a feed URL under their control. The malicious feed returns items containing JavaScript within titles, descriptions, or content fields. When an editor or administrator opens the campaign preview or item list, the browser parses the unescaped markup and executes the script under the reviewer's authenticated session. Payloads can create new administrator accounts, exfiltrate nonces, or modify site content.
No verified public exploit is available. Technical details are documented in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-89002
Indicators of Compromise
- Unexpected administrator or editor accounts created shortly after a reviewer accessed a WPeMatico campaign page
- WPeMatico campaigns configured with feed source URLs pointing to unfamiliar or newly registered domains
- Outbound requests from admin browsers to attacker-controlled hosts triggered by loading campaign pages
- Modified wp_options or wp_users records with no corresponding administrator action
Detection Strategies
- Audit the wp_posts and plugin-specific tables for WPeMatico campaign entries containing <script>, onerror=, onload=, or javascript: substrings
- Review WordPress activity logs for campaign edits authored by contributor-role users followed by administrator sessions on the same campaign
- Inspect browser network telemetry for admin-session requests to /wp-json/wp/v2/users or admin-ajax.php that were not initiated by the administrator
Monitoring Recommendations
- Alert on creation of privileged WordPress accounts outside change windows
- Monitor the WPeMatico plugin version across managed sites and flag any instance below 2.8.26
- Log and review outbound HTTP requests from the WordPress server that fetch RSS content from newly added feed URLs
How to Mitigate CVE-2026-89002
Immediate Actions Required
- Upgrade the WPeMatico RSS Feed Fetcher plugin to version 2.8.26 or later on all WordPress installations
- Review existing campaigns for feed URLs added by contributor accounts and remove any that are unrecognized
- Audit administrator and editor accounts for unauthorized additions and rotate credentials for reviewers who accessed suspicious campaigns
Patch Information
The vendor addressed the vulnerability in WPeMatico RSS Feed Fetcher version 2.8.26 by adding sanitization and escaping of fetched feed content prior to rendering. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict campaign creation to trusted roles by removing contributor access to the WPeMatico plugin until patched
- Disable the WPeMatico plugin on affected sites until the update to 2.8.26 can be deployed
- Enforce a strict Content Security Policy in the WordPress admin area to limit inline script execution
# Update WPeMatico via WP-CLI to the patched version
wp plugin update wpematico --version=2.8.26
wp plugin list --name=wpematico --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
