CVE-2026-89005: WPeMatico RSS Feed Fetcher XSS Vulnerability

CVE-2026-89005 Overview

CVE-2026-89005 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WPeMatico RSS Feed Fetcher WordPress plugin before version 2.8.26. The plugin fails to sanitise and escape one of its campaign configuration fields when a specific feature is enabled. Users with the Contributor role or higher can inject malicious JavaScript into campaign fields. The payload executes in the browser session of any higher-privileged user who later views the affected campaign.

Critical Impact
Authenticated low-privilege users can execute arbitrary JavaScript in the browsers of administrators, enabling account takeover, session hijacking, and persistent backdoor installation.

Affected Products

WPeMatico RSS Feed Fetcher WordPress plugin versions prior to 2.8.26
WordPress sites exposing Contributor-level accounts or higher to untrusted users
Any WPeMatico campaign using the affected configuration feature

Discovery Timeline

2026-09-24 - CVE-2026-89005 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-89005

Vulnerability Analysis

The WPeMatico plugin processes campaign configuration data submitted through the WordPress admin interface. When a specific feature is enabled, one of the campaign configuration fields accepts user input without applying output sanitisation or escaping. A Contributor can save a crafted payload into this field through normal plugin workflows.

When a higher-privileged user, such as an Editor or Administrator, later views the campaign, the browser renders the stored payload as executable JavaScript. The attack succeeds because WordPress Contributors can create and submit content but normally cannot execute script in administrative contexts. This vulnerability bypasses that security boundary.

The stored nature of the flaw means the payload persists in the database until manually removed. Each administrator who views the campaign re-triggers execution, amplifying the potential impact across multiple sessions.

Root Cause

The root cause is missing input sanitisation and output escaping on a specific campaign configuration field within the plugin. The plugin does not apply WordPress core helpers such as sanitize_text_field() on input or esc_html() / esc_attr() on output. User-supplied content is rendered directly into the admin page markup.

Attack Vector

An authenticated attacker with Contributor privileges logs into the target WordPress site. The attacker enables the vulnerable feature on a campaign and injects a JavaScript payload into the unsanitised configuration field. The payload remains dormant until an administrator or other higher-privileged user loads the campaign in the admin interface. On render, the script executes with the victim's session, allowing cookie theft, forced actions through the WordPress REST API, or creation of new administrator accounts.

The vulnerability requires user interaction, as a privileged user must view the campaign for the payload to fire. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-89005

Indicators of Compromise

Unexpected <script> tags, event handlers, or JavaScript URIs stored in WPeMatico campaign records within the wp_posts or plugin-specific tables
Creation of new WordPress administrator accounts shortly after a Contributor interacts with WPeMatico campaigns
Outbound HTTP requests from administrator browser sessions to attacker-controlled domains while viewing campaign pages
Modifications to WordPress plugin or theme files following administrator access to a WPeMatico campaign

Detection Strategies

Audit WPeMatico plugin version across all WordPress installations and flag any version below 2.8.26
Review stored campaign configuration fields for HTML tags, encoded JavaScript, or suspicious payloads using database queries
Enforce a strict Content Security Policy (CSP) on the WordPress admin interface to surface and block inline script execution attempts

Monitoring Recommendations

Monitor WordPress audit logs for Contributor-level accounts editing or creating WPeMatico campaigns
Alert on administrator session activity that follows unusual request patterns, such as mass REST API calls to /wp-json/wp/v2/users
Track plugin update status centrally and alert when WPeMatico installations remain on vulnerable versions

How to Mitigate CVE-2026-89005

Immediate Actions Required

Update the WPeMatico RSS Feed Fetcher plugin to version 2.8.26 or later on all WordPress installations
Review existing campaigns created or modified by Contributor-level accounts for malicious payloads and remove any suspicious content
Rotate administrator passwords and invalidate active sessions if evidence suggests payload execution occurred

Patch Information

The vendor addressed the vulnerability in WPeMatico RSS Feed Fetcher version 2.8.26 by adding proper sanitisation and escaping to the affected campaign configuration field. Administrators should install the patched release through the WordPress plugin manager or by deploying it through their configuration management tooling. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict Contributor role assignment to trusted users only until the patch is applied
Disable the WPeMatico feature associated with the vulnerable configuration field if operationally feasible
Deploy a web application firewall (WAF) rule that inspects WPeMatico campaign submissions for script tags and event-handler attributes

bash

# Update WPeMatico plugin using WP-CLI
wp plugin update wpematico --version=2.8.26

# Verify installed version
wp plugin get wpematico --field=version