Vendors / Perfmatters Records 8 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 7
Exploited now Perfmatters records in CISA KEV No Perfmatters vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 41
The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00941 · Published 2026-07-02 · No fix listed CWE-22
Priority MEDIUM 40
Missing Authorization vulnerability in Perfmatters.This issue affects Perfmatters: from n/a through 2.1.6.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00408 · Published 2024-02-29 · No fix listed CWE-862
Priority LOW 38
The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1.
CVSS 3.1 HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.0067 · Published 2026-04-03 · No fix listed CWE-22
Priority LOW 38
Cross-Site Request Forgery (CSRF) vulnerability in Perfmatters allows Cross Site Request Forgery.This issue affects Perfmatters: from n/a through 2.1.6.
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.0024 · Published 2023-11-30 · No fix listed CWE-352
Priority LOW 35
The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9.
CVSS 3.1 HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00416 · Published 2026-04-10 · No fix listed CWE-22
Priority LOW 31
Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.
CVSS 3.1 HIGH 7.1· Network · No auth · User interaction · EPSS 0.00251 · Published 2026-07-02 · No fix listed CWE-79
Priority LOW 31
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perfmatters allows Reflected XSS.This issue affects Perfmatters: from n/a through 2.1.6.
CVSS 3.1 HIGH 7.1· Network · No auth · User interaction · EPSS 0.00412 · Published 2023-11-30 · No fix listed CWE-79
Priority LOW 29
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perfmatters allows Stored XSS.This issue affects Perfmatters: from n/a before 2.2.0.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · User interaction · EPSS 0.00368 · Published 2023-11-30 · Fixed in 2.2.0 CWE-79
Open these records in search → All records by CVSS severity
0 7 1 0 0
THREATIST.IORead the docs