Monsterinsights

CVE-2026-11366 Aug 04, 06:00 LOW POC PATCH Monitor

Signature forgery in the MonsterInsights WordPress plugin before 11.1.0 allows unauthenticated network attackers to overwrite plugin configuration values when the site is not connected to Google Analytics. The root cause is that the HMAC signing key used to authenticate a specific AJAX action defaults to an empty string in that disconnected state, making any forged HMAC trivially valid. The practical impact is limited to disrupting server-side analytics in Manual GA4 mode; no public exploit identified as actively exploited (not in CISA KEV), though a publicly available proof-of-concept exists and the EPSS probability is low at 0.15%.

CVE-2024-5902 Jul 12, 22:15 HIGH This Week

The User Feedback - Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name parameter in all versions up. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-0903 Feb 22, 06:15 MEDIUM PATCH This Month

The User Feedback - Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_submitted' 'link' value in all. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2023-32291 Nov 30, 13:15 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MonsterInsights Pro allows Stored XSS.14.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-46153 Oct 27, 08:15 MEDIUM This Month

Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2023-39308 Sep 29, 14:15 MEDIUM POC This Month

Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-23880 Aug 08, 12:15 MEDIUM This Month

Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-23999 May 18, 11:15 MEDIUM This Month

Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-0081 Feb 06, 20:15 MEDIUM POC This Month

The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.