CVE-2026-89006

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.27

Description The plugin fails to sanitize imported feed content before it is stored as post content. This allows users with the Contributor role or higher to execute Stored Cross-Site Scripting (XSS) attacks, which occur when a malicious script is permanently stored on the target server and served to other users.

Recommendations Update WPeMatico RSS Feed Fetcher to version 2.8.27 or later.