Plausible Analytics
Monthly
Cross-tenant information disclosure in Plausible Analytics through 3.2.1 allows an authenticated site editor to reassign a traffic-change notification to another site by supplying that site's primary key as site_id, causing the attacker to receive the victim site's traffic alerts and visitor figures. The flaw is a CWE-915 mass-assignment issue in the update_traffic_change_notification handler; exploitation requires an editor-level account on an instance that hosts multiple sites and knowledge or enumeration of the target site_id. The supplied intelligence rates it moderate (CVSS 5.3, 'this_month' priority) with no KEV entry or EPSS score provided, and the referenced research write-up is not confirmed as working exploit code.
A privilege-escalation and site-takeover flaw in Plausible Analytics Community Edition through 3.2.1 lets an authenticated site editor read pending invitation and ownership-transfer IDs rendered on the settings/people page, then register an account under the exact invitee email bound to that ID and accept it. Successful exploitation requires an existing pending invitation or ownership transfer plus the ability to register using the invitee's email address, so the issue only applies to instances with outstanding invites and untrusted editor-level accounts. Impact is limited to integrity (assuming the invited role or taking site ownership), with no direct confidentiality or availability loss; no public exploit code is identified at time of analysis and the CVSS 4.0 score is 6.0 with the priority label this_month.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) in PlausibleHQ Plausible Analytics (WordPress plugin) <= 1.2.2. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-tenant information disclosure in Plausible Analytics through 3.2.1 allows an authenticated site editor to reassign a traffic-change notification to another site by supplying that site's primary key as site_id, causing the attacker to receive the victim site's traffic alerts and visitor figures. The flaw is a CWE-915 mass-assignment issue in the update_traffic_change_notification handler; exploitation requires an editor-level account on an instance that hosts multiple sites and knowledge or enumeration of the target site_id. The supplied intelligence rates it moderate (CVSS 5.3, 'this_month' priority) with no KEV entry or EPSS score provided, and the referenced research write-up is not confirmed as working exploit code.
A privilege-escalation and site-takeover flaw in Plausible Analytics Community Edition through 3.2.1 lets an authenticated site editor read pending invitation and ownership-transfer IDs rendered on the settings/people page, then register an account under the exact invitee email bound to that ID and accept it. Successful exploitation requires an existing pending invitation or ownership transfer plus the ability to register using the invitee's email address, so the issue only applies to instances with outstanding invites and untrusted editor-level accounts. Impact is limited to integrity (assuming the invited role or taking site ownership), with no direct confidentiality or availability loss; no public exploit code is identified at time of analysis and the CVSS 4.0 score is 6.0 with the priority label this_month.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) in PlausibleHQ Plausible Analytics (WordPress plugin) <= 1.2.2. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.