PT-2026-55014 · Perfmatters+1 · Perfmatters

Daroo

·

CVE-2026-57671

·

Published

2026-06-30

·

Updated

2026-07-02

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions Perfmatters versions prior to 2.6.5
Description The Perfmatters plugin for WordPress contains a Stored Cross-Site Scripting (XSS) flaw. This issue occurs due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute automatically whenever a user accesses the affected page.
Recommendations Update to a version newer than 2.6.4.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-57671

Affected Products

Perfmatters