CVE-2026-87760: Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name

Q: Who is exposed to this issue?

WordPress sites using Web Vitals Tracking version 5.4.2 or earlier are affected. An attacker does not need an account, but successful impact requires an administrator to view the affected administrative page where stored measurements are rendered.

Q: What does an attacker need to do to exploit it?

The attacker must submit a crafted tracking beacon containing a malicious performance metric name. The plugin stores that value and later outputs it in a script context on an administrative page, where it can execute when an administrator views it.

Q: Is user interaction required?

Yes. Although beacon submission can be performed without authentication, exploitation requires an administrator to visit the administrative page that displays the stored malicious measurement.

Published Oct 11, 2026

Updated

The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators.

Affected Software

1 affected component

WordPress Web Vitals Tracking<=5.4.2

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

WordPress sites using Web Vitals Tracking version 5.4.2 or earlier are affected. An attacker does not need an account, but successful impact requires an administrator to view the affected administrative page where stored measurements are rendered.

What does an attacker need to do to exploit it?

The attacker must submit a crafted tracking beacon containing a malicious performance metric name. The plugin stores that value and later outputs it in a script context on an administrative page, where it can execute when an administrator views it.

Is user interaction required?

Yes. Although beacon submission can be performed without authentication, exploitation requires an administrator to visit the administrative page that displays the stored malicious measurement.

CVE-2026-87760: Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Is user interaction required?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Is user interaction required?