Stored Cross-Site Scripting in Web Vitals Tracking Plugin for WordPress
CVE-2026-87760
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-87760?
The Web Vitals Tracking WordPress plugin, up to version 5.4.2, is prone to a security flaw due to its failure to properly validate or escape performance measurements submitted by unauthenticated visitors. This oversight allows malicious actors to inject harmful scripts, which are then stored and presented on administrative pages. Consequently, these Stored Cross-Site Scripting attacks can potentially compromise the integrity of the WordPress site and affect administrators' sessions.
Affected Version(s)
Web Vitals Tracking 0 <= 5.4.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.