Extension WordPress
Vulnérabilités Perfmatters
Cette page rassemble les failles publiées pour Perfmatters, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Perfmatters
9 fiches
Perfmatters <= 2.6.4 – Unauthenticated Arbitrary File Read via 's' Parameter
The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the…
*-2.6.4
2.6.5
01/07/2026
Perfmatters <= 2.6.4 – Unauthenticated Stored Cross-Site Scripting
The Perfmatters plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts…
*-2.6.4
2.6.5
30/06/2026
Perfmatters <= 2.6.3 – Reflected Cross-Site Scripting
The Perfmatters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts…
*-2.6.3
2.6.4
25/06/2026
Perfmatters <= 2.5.9 – Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter
The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9. This is due to the `PMCS::action_handler()` method processing the bulk action `activate`/`deactivate` handlers without any authorization…
*-2.5.9
2.6.0
09/04/2026
Perfmatters <= 2.5.9.1 – Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter
The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method processing the `$_GET['delete']` parameter without any sanitization, authorization check,…
*-2.5.9.1
2.6.0
02/04/2026
Perfmatters < 2.2.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting
The Perfmatters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in all versions up to 2.2.0 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…
[*, 2.2.0)
2.2.0
21/11/2023
Perfmatters <= 2.1.6 – Cross-Site Request Forgery
The Perfmatters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.6. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated…
*-2.1.6
2.1.7
21/11/2023
Perfmatters <= 2.1.6 – Reflected Cross-Site Scripting
The Perfmatters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
*-2.1.6
2.1.7
21/11/2023
Perfmatters <= 2.1.6 – Missing Authorization
The Perfmatters plugin for WordPress is vulnerable to unauthorized access, modification or loss of data due to a missing capability check on one of its functions in all versions up to, and including, 2.1.6. This makes it possible…
*-2.1.6
2.1.7
20/11/2023
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.