Perfmatters vulnerabilities
3 known CVE vulnerabilities in Perfmatters, translated and rated.
- CVE-2026-57671High
The Perfmatters plugin version 2.6.4 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
- CVE-2026-13251High
The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 2.6.4 via the 's' parameter. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information.
- CVE-2026-4350High
The Perfmatters plugin for WordPress up to version 2.5.9.1 is vulnerable to arbitrary file deletion via path traversal. The `PMCS::action_handler()` method processes the `$_GET['delete']` parameter without sanitization, authorization, or nonce verification, allowing authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server.