Web Vitals Tracking
Monthly
Stored cross-site scripting in the WordPress plugin Web Vitals Tracking (versions through 5.4.2) allows unauthenticated visitors to inject arbitrary script content by submitting unvalidated, unescaped performance measurements that the plugin persists and later renders inside a script context on an administrative reporting page. The attack is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but the payload only executes when a logged-in administrator loads the affected admin page, so exploitation depends on administrator activity rather than firing automatically; publicly available exploit code exists and the issue is tracked by WPScan as well as EUVD-2026-96769. Our independent assessment rates the impact more conservatively than the vendor/NVD score (scope-changed XSS with low confidentiality and integrity impact and no availability impact), so this should be treated as a credible, medium-to-high priority issue rather than a top-tier emergency.
Stored cross-site scripting in the WordPress plugin Web Vitals Tracking (versions through 5.4.2) allows unauthenticated visitors to inject arbitrary script content by submitting unvalidated, unescaped performance measurements that the plugin persists and later renders inside a script context on an administrative reporting page. The attack is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but the payload only executes when a logged-in administrator loads the affected admin page, so exploitation depends on administrator activity rather than firing automatically; publicly available exploit code exists and the issue is tracked by WPScan as well as EUVD-2026-96769. Our independent assessment rates the impact more conservatively than the vendor/NVD score (scope-changed XSS with low confidentiality and integrity impact and no availability impact), so this should be treated as a credible, medium-to-high priority issue rather than a top-tier emergency.