178 matches found
WordPress Web Vitals Tracking plugin <= 5.4.2 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Web Vitals Tracking versions = 5.4.2...
CVE-2026-87760
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site...
CVE-2026-87760 Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site...
EUVD-2026-96769
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site...
CVE-2026-87760 Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site...
CVE-2026-87760
The Web Vitals Tracking WordPress plugin, in versions through 5.4.2 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to validate or escape performance measurements submitted by unauthenticated visitors before storing and subsequently outputting them within a scri...
PT-2026-110043
Name of the Vulnerable Software and Affected Versions Web Vitals Tracking WordPress plugin versions prior to 5.4.3 Description Unauthenticated visitors can submit performance measurements that are stored and subsequently output within a script context on an administrative page without proper...
CVE-2026-87760: Improper Neutralization of Input During Web Page Generation
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site...
Malicious Package
Overview web-vitals-polyfill-core-v1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malware in web-vitals-polyfill-core-v1
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in web-vitals-polyfill-core-v1 (npm)
Source: amazon-inspector 38311c0f483e9485a7b5e8aa7f9a093a40203d8e1a025c0bf5850c2874cffdfa The package name mimics the widely-used web-vitals polyfill but the tarball ships disk/index.min.js, a base64-wrapped service-worker payload self.PWAROUTER.executeTacticalRouting that resolves an active...
Malicious code in web-vitals-polyfill-core-v1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38311c0f483e9485a7b5e8aa7f9a093a40203d8e1a025c0bf5850c2874cffdfa The package name mimics the widely-used web-vitals polyfill but the tarball ships disk/index.min.js, a base64-wrapped service-worker payload...
MAL-2026-17303 Malicious code in web-vitals-polyfill-core-v1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38311c0f483e9485a7b5e8aa7f9a093a40203d8e1a025c0bf5850c2874cffdfa The package name mimics the widely-used web-vitals polyfill but the tarball ships disk/index.min.js, a base64-wrapped service-worker payload...
CVE-2026-95528
Unauthenticated Cross Site Scripting XSS in Core Web Vitals & PageSpeed Booster = 1.0.31 versions...
CVE-2026-95528 WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Core Web Vitals & PageSpeed Booster = 1.0.31 versions...
EUVD-2026-85496
Unauthenticated Cross Site Scripting XSS in Core Web Vitals & PageSpeed Booster = 1.0.31 versions...
CVE-2026-95528 WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Core Web Vitals & PageSpeed Booster = 1.0.31 versions...
CVE-2026-95528
The Core Web Vitals & PageSpeed Booster WordPress plugin, in versions
WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Nhat Long in WordPress Plugin Core Web Vitals & PageSpeed Booster versions = 1.0.31...