Unauthenticated Cross Site Scripting exists in versions of the WordPress Perfmatters plugin up to 2.6.3. The flaw allows an attacker to inject arbitrary client‑side script when a user visits a specially crafted URL or submits malicious data, executing that code in the victim's browser. This can lead to session hijacking, credential theft, defacement or further compromise of the site. The weakness is an input validation issue identified as CWE‑79.

The affected product is the Perfmatters WordPress plugin, any WordPress installation using Perfmatters version 2.6.3 or earlier. The vendor responsible for the patch is Perfmatters, and the plugin is commonly bundled with the Kinsta hosting service and used in GeneratePress themes.

The CVSS score of 7.1 indicates a high level of severity. No EPSS score is available, so the likelihood of exploitation in the wild is unknown, but the vulnerability is not currently listed in CISA's KEV catalog. The flaw can be exploited remotely by unauthenticated users who can craft or influence browser requests to the site, making it potentially open to widespread attacks. The typical attack vector would be a reflected XSS payload delivered via a request to a vulnerable endpoint that accepts query parameters or form inputs without proper sanitization.