CVE-2026-89005: WPeMatico RSS Feed Fetcher XSS Vulnerability

CVE-2026-89005 Overview

CVE-2026-89005 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin before version 2.8.26. The plugin fails to sanitize and escape one of its campaign configuration fields when a specific feature is enabled. Authenticated users with the Contributor role or above can inject malicious scripts that execute in the browser session of any higher-privileged user who later views the affected campaign. The flaw is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
A Contributor-level attacker can escalate privileges by hijacking Administrator sessions through stored JavaScript payloads executed in the WordPress admin dashboard.

Affected Products

WPeMatico RSS Feed Fetcher WordPress plugin versions prior to 2.8.26
WordPress installations with the vulnerable plugin activated
Sites permitting Contributor-role or higher user registration

Discovery Timeline

2026-09-24 - CVE-2026-89005 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-89005

Vulnerability Analysis

The vulnerability resides in the WPeMatico plugin's campaign configuration handling. When a specific feature is enabled, one of the campaign fields accepts user-supplied input without applying WordPress sanitization functions such as sanitize_text_field() or output escaping helpers like esc_html() and esc_attr().

An attacker holding a Contributor account can inject JavaScript into the affected field. The payload is persisted in the WordPress database and rendered without escaping when higher-privileged users, such as Editors or Administrators, view the campaign. The script executes with the target user's session context inside the WordPress admin interface.

Exploitation can lead to session token theft, unauthorized creation of administrator accounts, plugin or theme modification, and delivery of secondary payloads to site visitors.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on render for a campaign configuration field gated behind a specific plugin feature. WordPress plugin development guidelines require both defenses, and their absence permits arbitrary HTML and JavaScript to persist in plugin data.

Attack Vector

Exploitation requires an authenticated account with at least Contributor privileges and user interaction from a higher-privileged victim. The attacker creates or edits a WPeMatico campaign, submits a payload containing JavaScript in the vulnerable field, and waits for an Administrator or Editor to open the campaign in the WordPress dashboard. The injected script then executes in the victim's authenticated session.

Refer to the WPScan Vulnerability Advisory for additional technical details.

Detection Methods for CVE-2026-89005

Indicators of Compromise

Unexpected <script> tags, onerror=, or onload= handlers stored within WPeMatico campaign records in the wp_posts or plugin-specific tables
New WordPress administrator accounts created shortly after a Contributor accessed campaign editing pages
Outbound requests from admin browser sessions to unfamiliar domains during campaign review
Modified plugin, theme, or wp_options values with no corresponding change ticket

Detection Strategies

Query the WordPress database for campaign entries containing HTML event handlers or script tags
Review WPeMatico plugin audit logs for campaign field edits performed by Contributor-role accounts
Enable WordPress security plugins that log role changes, user creation, and file modifications
Compare installed WPeMatico plugin version against the fixed release 2.8.26 across all managed sites

Monitoring Recommendations

Alert on creation or promotion of WordPress users to Administrator or Editor roles
Monitor web server access logs for POST requests to admin.php?page=wpematico endpoints originating from low-privileged accounts
Capture and inspect Content Security Policy (CSP) violation reports from the WordPress admin origin

How to Mitigate CVE-2026-89005

Immediate Actions Required

Update the WPeMatico RSS Feed Fetcher plugin to version 2.8.26 or later on all WordPress installations
Audit existing campaigns for stored HTML or JavaScript payloads and remove any suspicious entries
Review recently created user accounts and revoke unauthorized Administrator or Editor privileges
Rotate credentials and invalidate active sessions for all privileged WordPress users

Patch Information

The vendor addressed the vulnerability in WPeMatico RSS Feed Fetcher version 2.8.26. Administrators should apply the update through the WordPress plugin dashboard or via WP-CLI. See the WPScan Vulnerability Advisory for advisory details.

Workarounds

Restrict Contributor-level and above account registration until the plugin is patched
Disable the specific WPeMatico feature that exposes the vulnerable field if patching is not immediately possible
Deploy a web application firewall (WAF) with rules that block script-tag and event-handler payloads submitted to plugin admin endpoints
Enforce a strict Content Security Policy on the WordPress admin interface to limit inline script execution

bash

# Update WPeMatico plugin using WP-CLI
wp plugin update wpematico --version=2.8.26

# Verify installed version
wp plugin get wpematico --field=version

# List users with Contributor role or higher for audit
wp user list --role=contributor --fields=ID,user_login,user_registered