Web Vitals Tracking WordPress plugin: Unauthenticated stored XSS via metric name
Summary
The Web Vitals Tracking WordPress plugin up to version 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors. The stored data is output in a script context on an administrative page. An unauthenticated attacker can therefore inject JavaScript that runs in the browser of an administrator who views that page, which can lead to compromise of the administrator's WordPress session.
Affected
- Web Vitals Tracking WordPress plugin (slug web-vitals-tracking), all versions up to and including 5.4.2
Fixed in
- Unknown. WPScan lists the status as "No known fix".
Workaround
- Unknown. No workaround is documented in the CVE record or the WPScan entry.
Exploitation
- No evidence of active exploitation found. The CVE is not listed in the CISA KEV catalog.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS 0.00185 (as listed by PT-2026-110043).
- Public proof of concept: unclear.
Our recommendation
- Deactivate and delete the plugin if it is not required. This is the only complete mitigation known.
- If the plugin must remain, limit WordPress administrator accounts to trusted staff and enforce strong authentication for admins.
- Review the plugin's admin pages and stored tracking data for unexpected content.
- Keep WordPress core and other plugins up to date and monitor the WPScan entry for a fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- OpenCVE CVE-2026-87760 app.opencve.io
- VulDB CVE-2026-87760 vuldb.com
- WordPress.org plugin page wordpress.org
- Vulners PT-2026-110043 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:40.
Original description (NVD)
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.