CVE-2026-87760

Summary

The WordPress Web Vitals Tracking plugin has a stored XSS vulnerability that allows unauthenticated users to inject malicious scripts into admin pages. When administrators view performance data, they execute attacker-controlled code in their browser context.

Exploitability

Exploitation is relatively easy as it requires only a visitor to submit crafted performance measurements, with no authentication or user interaction needed from the administrator beyond viewing the affected admin page.

Blast radius

The impact could be significant as attackers could steal administrator sessions, perform actions as admin, or redirect them to malicious sites, potentially leading to full site compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 5.4.3 or later which contains the fix for this stored XSS vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.