CVE-2026-56047

HighCVSS 7.1

Published: 26/06/2026(UTC)Updated: 26/06/2026(UTC)Translated: 27/06/2026(UTC)NVD NIST

Summary

The Perfmatters plugin version 2.6.3 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without authentication.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or perform other harmful actions in the victim's browser.

Recommendation

Immediately update the Perfmatters plugin to version 2.6.4 or later, which fixes this vulnerability.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.