Independent Analytics Pro
Monthly
Stored cross-site scripting in the Independent Analytics Pro WordPress plugin (all versions up to and including 2.15.5) lets unauthenticated attackers inject arbitrary web scripts through the 'utm_campaign' parameter, which execute when a victim later views the compromised page. The paid Pro build must be active - the free build nulls campaign parameters and is unaffected - and exploitation requires first fetching a frontend page to obtain a server-signed payload, then replaying it against the unauthenticated /iawp/search REST endpoint, because the signature check does not cover utm_* fields. Rated CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no confirmed active exploitation and no verified working exploit code from the available sources.
Stored cross-site scripting in the Independent Analytics Pro WordPress plugin (all versions up to and including 2.15.5) lets unauthenticated attackers inject arbitrary web scripts through the 'utm_campaign' parameter, which execute when a victim later views the compromised page. The paid Pro build must be active - the free build nulls campaign parameters and is unaffected - and exploitation requires first fetching a frontend page to obtain a server-signed payload, then replaying it against the unauthenticated /iawp/search REST endpoint, because the signature check does not cover utm_* fields. Rated CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no confirmed active exploitation and no verified working exploit code from the available sources.