6.8
Medium
CVE-2026-89006 The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing…
Description
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPeMatico RSS Feed Fetcher 2.8 | earliest → < 2.8.27 | 2.8.27 |
Other CVEs of WPeMatico RSS Feed Fetcher
The 9 CVEs of WPeMatico RSS Feed Fetcher →
CVE-2026-89001
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is…
4.9
Medium
CVE-2026-89003
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a…
4.1
Medium
CVE-2026-89000
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the…
4.1
Medium
CVE-2026-89005
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign…
6.8
Medium