CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PineWise WP Google Analytics Events allows Reflected XSS.This issue affects WP Google Analytics Events: from n/a through 2.8.0.
Explanation of Vulnerability in Simple Terms
WP Google Analytics Events versions up to 2.8.0 contain a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in the browsers of site administrators and other users. The vulnerability requires user interaction to trigger, such as clicking a malicious link. Successful exploitation can lead to unauthorized actions, data theft, or malware distribution.
What an attacker can do
Inject malicious scripts that run in users' browsers when they interact with the plugin.
Potential impact on your site
Attackers can steal admin credentials, modify site content, or inject malware affecting all site visitors.
Conditions required to exploit
No authentication required. Victim must click a link or visit a page containing the malicious payload.
Key dates
External resources
Related vulnerabilities
