Analytics Insights Google Analytics Dashboard For Wordpress
Monthly
Stored cross-site scripting in the Analytics Insights - Google Analytics Dashboard for WordPress plugin allows script injection through the Page Title in versions up to and including 6.3.12, executing when a user later accesses the affected page. The supplied CVSS 3.1 vector is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), and EPSS is 0.24% at the 15th percentile, with no CISA KEV entry and no public exploit identified at time of analysis. The vector indicates unauthenticated, no-interaction exploitation, but the sources do not describe the exact endpoint or input path by which an unauthenticated attacker sets the Page Title.
Stored cross-site scripting in the Analytics Insights - Google Analytics Dashboard for WordPress plugin allows script injection through the Page Title in versions up to and including 6.3.12, executing when a user later accesses the affected page. The supplied CVSS 3.1 vector is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), and EPSS is 0.24% at the 15th percentile, with no CISA KEV entry and no public exploit identified at time of analysis. The vector indicates unauthenticated, no-interaction exploitation, but the sources do not describe the exact endpoint or input path by which an unauthenticated attacker sets the Page Title.