high8.8
CVE-2026-87760
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storin…
Impact
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators.
Affected products
| Product | Affected versions |
|---|---|
| Web Vitals Tracking WordPress Plugin | through 5.4.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.