{"id":"CVE-2026-87760","published":"2026-10-11T07:17:26.573","lastModified":"2026-10-13T20:36:00.850","description":"The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/c6250c43-42c5-4c76-9eb9-2b35ba461e8c/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WordPress Web Vitals Tracking plugin has a stored XSS vulnerability that allows unauthenticated users to inject malicious scripts into admin pages. When administrators view performance data, they execute attacker-controlled code in their browser context.","exploitability":"Exploitation is relatively easy as it requires only a visitor to submit crafted performance measurements, with no authentication or user interaction needed from the administrator beyond viewing the affected admin page.","blast_radius":"The impact could be significant as attackers could steal administrator sessions, perform actions as admin, or redirect them to malicious sites, potentially leading to full site compromise.","remediation":"Upgrade to version 5.4.3 or later which contains the fix for this stored XSS vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","wordpress","web"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:54:27.595Z"}}