Threats tagged 'ghsa-cv7w-3p2j-xhxx'

The Independent Analytics WordPress plugin up to version 2.15.0 is vulnerable to stored Cross-Site Scripting (XSS) via the 404 not_found_url tracking parameter. This occurs because the plugin improperly decodes URL-encoded input after URL validation, allowing malicious HTML to be injected and executed in users' browsers. The vulnerability can be exploited without authentication due to a public REST endpoint that accepts signed requests embedded in public page HTML.