Analytics Insights EUVD-2026-110599

Requires the Analytics Insights - Google Analytics Dashboard for WordPress plugin (vendor deconf) to be installed and active on versions up to and including 6.3.12. The specific sink is the Page Title, which the plugin stores with insufficient input sanitization and renders with insufficient output escaping (CWE-79). The supplied vector marks it unauthenticated (PR:N) with no user interaction (UI:N), but the available sources do not describe the exact endpoint or input path by which an unauthenticated attacker sets the Page Title, so that prerequisite is unverified. Exploitation is limited in that it is stored/persistent: the payload only executes when a user later loads the affected injected page, and impact is confined to script execution in that viewer's browser context.

The signals pull in different directions. The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) is elevated primarily by the unauthenticated, network-reachable vector combined with a changed scope (S:C) typical of Wordfence stored-XSS scoring, even though the per-component impact is only Low/Low/None. Against that, the exploitation signals are weak: EPSS is 0.24% (15th percentile), there is no CISA KEV listing, and no proof-of-concept or exploit-code reference appears in the inputs. The vuln.today decision label is 'this_week', indicating a near-term but non-emergency remediation priority. Taken together this is a genuine but moderate-priority issue: unauthenticated stored XSS in a WordPress plugin is worth patching promptly, but the low EPSS and absence of any exploitation or PoC evidence indicate it is not under active or widespread attack. One point to verify with the vendor: the CVSS vector asserts PR:N (unauthenticated) and UI:N, yet the description does not explain how an unauthenticated actor controls the 'Page Title' sink - the injection mechanism is not described in the available sources, so the unauthenticated/no-interaction assumptions rest on the Wordfence-supplied vector rather than a documented attack path.

An unauthenticated attacker submits a crafted Page Title containing JavaScript to the Analytics Insights plugin, which stores it without adequate sanitization and later renders it without output escaping. When an administrator or other user subsequently views the affected page, the injected script executes in their browser session, enabling actions such as session/cookie theft or performing authenticated actions as the viewing user. No public exploit code is referenced in the available sources; the exact unauthenticated input path for the Page Title is not described.