CVE-2026-57671
HighCVSS 7.1Summary
The Perfmatters plugin version 2.6.4 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
Risk Assessment
The risk involves the possibility of executing arbitrary JavaScript code in the victim's browser, which can lead to session theft, redirects to malicious sites, or data theft.
Recommendation
It is recommended to immediately update the Perfmatters plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Perfmatters
See all- CVE-2026-13251High
The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 2.6.4 via the 's' parameter. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information.
- CVE-2026-4350High
The Perfmatters plugin for WordPress up to version 2.5.9.1 is vulnerable to arbitrary file deletion via path traversal. The `PMCS::action_handler()` method processes the `$_GET['delete']` parameter without sanitization, authorization, or nonce verification, allowing authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.