Threats tagged 'ghsa-6mh9-xw64-vrmx'

The Independent Analytics Pro WordPress plugin is vulnerable to a stored cross-site scripting (XSS) flaw via the 'utm_campaign' parameter in all versions up to and including 2.15.5. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. Exploitation requires the Pro build to be active and involves replaying a server-signed payload with a crafted utm_campaign value against an unauthenticated REST endpoint.