CVE-2026-89002

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.26

Description The plugin fails to sanitize and escape content retrieved from a user-supplied source before rendering it. This allows users with contributor-level permissions or higher to execute Stored Cross-Site Scripting (XSS) attacks—a technique where malicious scripts are permanently stored on the target server—against higher-privileged users who review the campaign.

Recommendations Update WPeMatico RSS Feed Fetcher to version 2.8.26 or later.