CVE-2026-17506 is a stored cross-site scripting vulnerability in the Independent Analytics WordPress plugin (up to and including version 2.15.0). The issue stems from the get_cell_content() function applying urldecode() after esc_url() when rendering the URL column for 404 entries, allowing percent-encoded HTML to pass URL validation and be reconstructed as raw markup. The wp_kses_post() function does not remove certain elements like img and data-* attributes, which facilitates the injection of arbitrary web scripts. Additionally, the public REST endpoint /iawp/search accepts unauthenticated requests if they carry a signature embedded in public page HTML, enabling unauthenticated attackers to inject malicious scripts that execute when users visit the injected pages.

An unauthenticated attacker can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of users visiting affected pages. This can lead to information disclosure or manipulation of user interactions within the affected site. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and low confidentiality and integrity impacts with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's REST endpoint if possible and monitor for suspicious activity. Avoid relying on the plugin for critical analytics functions without mitigation. Follow vendor updates closely for an official fix.