Web Vitals Tracking EUVD-2026-96769

Exploitation requires the target site to be running the Web Vitals Tracking plugin (version through 5.4.2) with its unauthenticated visitor-side performance-measurement submission endpoint reachable - the plugin stores visitor-supplied metrics and renders them in a script context on an administrative page without validation or escaping. No attacker authentication is needed (PR:N). The key limiting factor is UI:R: the payload only fires when a logged-in administrator views the affected admin reporting page, so exploitation is contingent on admin activity rather than firing automatically. There is no indication of a non-default configuration requirement; the stored-and-rendered behavior appears inherent to the plugin.

Signals are moderately aligned toward a credible but not top-tier priority. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) correctly captures a remotely reachable, unauthenticated, low-complexity injection that nonetheless requires victim interaction - specifically an administrator viewing the affected admin page - which is why UI:R is present. Publicly available exploit code exists (WPScan), raising the practical likelihood of opportunistic use, but there is NO CISA KEV listing and NO EPSS score was provided in the input, so widespread automated exploitation cannot be confirmed from the data. The NVD C:H/I:H/A:H impact rating (driving the 8.8) is debatable for a stored-XSS/CWE-79 issue: raw XSS confidentiality/integrity impact is typically Low, and the High rating appears to assume full administrator-session takeover leading to site compromise - plausible in WordPress (admin JS can create rogue admins or abuse the plugin/theme editor for code execution) but an inference rather than a directly demonstrated impact. Net: a real, patch-worthy vulnerability whose true risk hinges on the UI:R requirement and the admin-escalation assumption; treat as elevated for exposed WordPress sites running this plugin, but not as an actively-exploited emergency absent KEV/EPSS evidence.

An unauthenticated visitor submits crafted performance-measurement data containing a malicious script payload to the Web Vitals Tracking plugin, which stores it without validation or escaping. When a logged-in administrator later opens the plugin's reporting page in wp-admin, the payload executes in a script context in their browser, letting the attacker act with the admin's privileges (e.g., create a rogue admin account or inject site code). Public exploit code for this flaw is available via WPScan, lowering the barrier to reproduction.