Perfmatters

Perfmatters has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 9 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 4 high. 2026 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (44%). Other recurring categories include Path Traversal, Cross-Site Request Forgery (CSRF).

Every one of the 9 issues recorded for Perfmatters has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (4) reported by Dave Jong.

Strategic Overview

Avg CVSSMedium

6.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Perfmatters vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2026-4351

Perfmatters <= 2.5.9 - Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter

Read the full analysis

Vulnerability Records

9 records


2026-07-01 21:08	Perfmatters <= 2.6.4 - Unauthenticated Arbitrary File Read via 's' Parameter Perfmatters <= 2.6.4	`CVE-2026-13251`	7.5 High	daroo	Yes
2026-06-30 00:00	Perfmatters <= 2.6.4 - Unauthenticated Stored Cross-Site Scripting Perfmatters <= 2.6.4	`CVE-2026-57671`	7.2 High	daroo	Yes
2026-06-25 00:00	Perfmatters <= 2.6.3 - Reflected Cross-Site Scripting Perfmatters <= 2.6.3	`CVE-2026-56047`	6.1 Medium	dutafi	Yes
2026-04-09 11:55	Perfmatters <= 2.5.9 - Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter Perfmatters <= 2.5.9	`CVE-2026-4351`	8.1 High	h0xilo	Yes
2026-04-02 19:02	Perfmatters <= 2.5.9.1 - Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter Perfmatters <= 2.5.9.1	`CVE-2026-4350`	8.1 High	h0xilo	Yes
2023-11-21 00:00	Perfmatters <= 2.1.6 - Reflected Cross-Site Scripting Perfmatters <= 2.1.6	`CVE-2023-47876`	6.1 Medium	Dave Jong	Yes
2023-11-21 00:00	Perfmatters <= 2.1.6 - Cross-Site Request Forgery Perfmatters <= 2.1.6	`CVE-2023-47875`	4.3 Medium	Dave Jong	Yes
2023-11-21 00:00	Perfmatters < 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting Perfmatters < 2.2.0	`CVE-2023-47877`	6.4 Medium	Dave Jong	Yes
2023-11-20 00:00	Perfmatters <= 2.1.6 - Missing Authorization Perfmatters <= 2.1.6	`CVE-2023-47874`	5.3 Medium	Dave Jong	Yes

Showing 1–9 of 9 reports