What is the CVSS score of CVE-2026-56047?

CVE-2026-56047 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Perfmatters are affected by CVE-2026-56047?

Perfmatters WordPress plugin (versions 2.6.3 and earlier) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to compromise administrator sessions and inject…

How to fix or mitigate CVE-2026-56047?

Within 24 hours: Inventory all WordPress installations using Perfmatters and verify installed versions against 2.6.3. Within 7 days: Disable the Perfmatters plugin on all affected sites; review administrative logs for evidence of exploitation; notify end users of potential exposure. Within 30 days: Monitor Perfmatters vendor advisory for patch availability; evaluate replacement plugin alternatives; implement Web Application Firewall rules to block reflected XSS patterns if plugin re-enablement is required.

Perfmatters CVE-2026-56047

EUVD-2026-39708 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-77r4-g858-h4qm

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable reflected XSS needs no auth (PR:N) but requires the victim to open a crafted link (UI:R); script crossing into the admin origin justifies S:C with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:01 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.

AnalysisAI

Reflected cross-site scripting in the Perfmatters WordPress plugin (versions 2.6.3 and earlier) allows unauthenticated attackers to inject malicious script that executes in a victim's browser when they follow a crafted link. The scope-changed CVSS 3.1 score of 7.1 reflects that successful exploitation can affect resources beyond the vulnerable component, such as an authenticated administrator's session. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Perfmatters is a commercial WordPress performance-optimization plugin that disables unneeded WordPress features, manages script loading, and tunes caching behavior across large numbers of sites. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected back into an HTML response without adequate output encoding or input sanitization. Because this is reflected (non-persistent) XSS reachable without authentication, the malicious payload travels in the request itself - typically a query parameter - and is echoed into the page, where the browser interprets it as executable script in the context of the WordPress site's origin.

RemediationAI

Upgrade Perfmatters to the vendor's fixed release above 2.6.3; an exact patched version number was not included in the provided data, so confirm the current secure version directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/perfmatters/vulnerability/wordpress-perfmatters-plugin-2-6-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) and the plugin's WordPress.org changelog before applying. Where immediate patching is not possible, place the site behind a WAF or Patchstack's virtual-patching ruleset to filter reflected XSS payloads, restrict and monitor links delivered to administrators, and instruct privileged users not to follow untrusted links to the site; note that WAF rules can produce false positives and do not replace the actual fix. Because exploitation requires victim interaction, administrator awareness and link hygiene meaningfully reduce real-world risk until the upgrade is deployed.