What the vulnerability does
01Description
A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this vulnerability is an unknown functionality of the file class-tgm-plugin-activation.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.7 is able to address this issue. The identifier of the patch is 25bb1dea113716200a6f0f3135801d84a7a65540. It is recommended to upgrade the affected component. The identifier VDB-226117 was assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Google Analytics Top Content Widget Plugin contains a stored cross-site scripting (XSS) vulnerability in versions 1.5.0 and earlier. An authenticated user with low privileges can inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction to trigger and affects only the integrity of the site, not confidentiality or availability.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers when they view affected pages.
Potential impact on your site
04Site Impact
Authenticated users can deface content or steal session tokens from site visitors viewing affected pages.
Conditions required to exploit
05Prerequisites
Attacker must be logged in with low-level privileges; victim must visit a page containing the injected content.
Key dates
06Disclosure timeline
April 15, 2023
CVE published
November 22, 2024
Record updated
