What is GHSA-gw77-m839-mhwc?

GHSA-gw77-m839-mhwc is a security advisory published by GitHub Security Advisories with Medium severity. The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of...

Which CVE IDs does GHSA-gw77-m839-mhwc cover?

GHSA-gw77-m839-mhwc covers the following CVE IDs: CVE-2026-89005. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gw77-m839-mhwc?

GHSA-gw77-m839-mhwc has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-gw77-m839-mhwcMediumCVSS 6.8

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of...

Vendor

GitHub Security Advisories

Published

September 24, 2026

Last Modified

September 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-89005 →

📋 Description

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session of any higher-privileged user who later views the campaign.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-89005
https://wpscan.com/vulnerability/1c6f4da0-d7e8-4f50-851f-f794552db985
https://github.com/advisories/GHSA-gw77-m839-mhwc