What is the CVSS score of CVE-2026-57671?

CVE-2026-57671 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Perfmatters are affected by CVE-2026-57671?

Perfmatters WordPress plugin (versions 2.6.4 and earlier) contains an unauthenticated cross-site scripting vulnerability that allows attackers to inject malicious scripts executed in website…

How to fix or mitigate CVE-2026-57671?

Within 24 hours: Inventory all WordPress installations using Perfmatters plugin version 2.6.4 or earlier and disable the plugin immediately. Within 7 days: Monitor vendor security advisories for patch availability; implement Web Application Firewall rules to block XSS payloads targeting the plugin. Within 30 days: Apply vendor-released patch once available, or migrate to an alternative performance plugin with documented security review.

Perfmatters CVE-2026-57671

EUVD-2026-41282 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-6fv7-2mhh-75mr

WordPress XSS Perfmatters Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:19 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.

AnalysisAI

Cross-site scripting in the Perfmatters WordPress performance plugin (versions 2.6.4 and earlier) allows unauthenticated remote attackers to inject malicious script that executes in a victim's browser when they interact with a crafted request or link. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable, no-authentication exploitation gated by user interaction, with a scope change into the victim's browser context. There is no public exploit identified at time of analysis and the issue is not in CISA KEV.