CVE-2026-87760 Web Vitals Tracking CVE debrief

Who should care

Administrators of WordPress installations with the Web Vitals Tracking plugin should assess their exposure and take defensive actions to prevent Stored Cross-Site Scripting attacks.

Why it matters

The Web Vitals Tracking WordPress plugin vulnerability allows unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. Administrators should assess their exposure and take defensive actions to prevent attacks.

• Unauthenticated attackers can perform Stored Cross-Site Scripting attacks against administrators
• Administrators should verify plugin version and update to a patched version if available
• Review administrative page inputs for suspicious activity

Technical summary

The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page. This allows unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. The plugin's failure to validate or escape user-submitted data enables attackers to inject malicious scripts, potentially leading to unauthorized actions or data breaches. Administrators should verify the plugin version and update to a patched version if available, review administrative page inputs for suspicious activity, and monitor for potential Stored Cross-Site Scripting

Defensive priority

Administrators of WordPress installations with the Web Vitals Tracking plugin should verify the plugin version and update to a patched version if available. They should also review administrative page inputs for suspicious activity.

Recommended defensive actions

• Verify the plugin version and update to a patched version if available
• Review administrative page inputs for suspicious activity
• Monitor for potential Stored Cross-Site Scripting attacks
• Perform a thorough review of the plugin's configuration and settings
• Implement additional security measures to detect and prevent similar attacks
• Conduct regular security audits to identify potential vulnerabilities
• Establish a process for tracking and addressing plugin updates and security advisories

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The Web Vitals Tracking WordPress plugin through 5.4.2 is vulnerable to Stored Cross-Site Scripting attacks. However, details about exploitation, impact, and remediation are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.