EUVD-2026-53339
GHSA-cv7w-3p2j-xhxx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
UI:R assessed because payload execution requires an admin to view the 404 analytics table; injection itself is unauthenticated (PR:N) via publicly-signed REST endpoint.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 not_found_url tracking parameter in versions up to, and including, 2.15.0. This is due to the get_cell_content() function applying urldecode() after esc_url() when rendering the URL column for 404 entries - a sequence that allows percent-encoded HTML to pass URL validation and then be reconstructed as raw markup, which wp_kses_post() does not strip because it retains img elements and data-* attributes, and because the public REST endpoint /iawp/search accepts unauthenticated requests as long as they carry a signature that is itself embedded in public page HTML. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Independent Analytics WordPress plugin (≤2.15.0) permits unauthenticated attackers to plant persistent malicious scripts via the 404 not_found_url tracking mechanism. The flaw exploits a broken sanitization sequence in get_cell_content(): esc_url() encodes special characters as safe URL entities, but a subsequent urldecode() call reconstructs raw HTML before rendering - and wp_kses_post() fails to strip the resulting markup because it explicitly permits img elements and data-* attributes. The attack entry point, the /iawp/search REST endpoint, accepts requests signed with a token that is itself embedded in public-facing page HTML, making injection effectively unauthenticated. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Technical ContextAI
The Independent Analytics plugin (CPE: cpe:2.3:a:bensibley:independent_analytics_-_wordpress_analytics_plugin:*:*:*:*:*:*:*:*) tracks 404 error events including the originating URL. The rendering pipeline in IAWP/Tables/Table.php at line 142 calls esc_url() on the stored URL to sanitize output, but then passes the result through urldecode() - reversing the encoding and allowing percent-encoded HTML entities (e.g., %3Cimg%20src%3Dx%20onerror%3D...%3E) to become live markup in the page. WordPress's wp_kses_post() is the downstream filter, but it is insufficient here: it intentionally preserves img tags and data-* attributes, which are sufficient vectors for XSS payloads such as onerror handlers. The REST endpoint (/iawp/search, REST_API.php lines 86 and 458) enforces only a signature check - but that signature is embedded in every public WordPress page generated by the plugin (View.php line 206), so any unauthenticated visitor can extract it and submit signed requests. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class, specifically a defense-bypass via double-encoding.
RemediationAI
A fix commit exists in the plugin trunk (https://plugins.trac.wordpress.org/changeset?reponame=&new=3627446%40independent-analytics%2Ftrunk%2FIAWP%2FUtils%2FRequest.php&old=3618630%40independent-analytics%2Ftrunk%2FIAWP%2FUtils%2FRequest.php), indicating upstream fix is available; however, the exact released patched version number is not independently confirmed from available data - verify the published version in the WordPress plugin repository changelog before updating. Site owners should update Independent Analytics to any version beyond 2.15.0 via the WordPress admin plugin update screen as the primary remediation. As a compensating control, restrict access to the /iawp/search REST API endpoint using a WAF rule or server-level IP allowlist limited to trusted admin IPs - note this will break the plugin's analytics search functionality for users outside the allowlist. Additionally, restricting admin access to the analytics dashboard to MFA-protected accounts limits the impact window between injection and execution.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today