CVE-2026-17506 describes a stored Cross-Site Scripting vulnerability in the Independent Analytics WordPress plugin (versions up to and including 2.15.0). The issue arises from the get_cell_content() function applying urldecode() after esc_url() when rendering the URL column for 404 entries. This sequence allows percent-encoded HTML to bypass URL validation and be reconstructed as raw markup. The wp_kses_post() function does not remove certain HTML elements like img and data-* attributes, enabling script injection. Additionally, the public REST endpoint /iawp/search accepts unauthenticated requests if they carry a signature embedded in public page HTML, allowing unauthenticated attackers to inject arbitrary web scripts that execute when users access the injected pages.

An unauthenticated attacker can inject persistent malicious scripts into pages viewed by other users, leading to potential theft of credentials, session hijacking, or other malicious actions in the context of affected users. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS score is 7.2 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and scope changed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the plugin or restricting access to the affected REST endpoint if possible. Monitor vendor channels for updates and apply official patches once released.