cornelraiu-1 vulnerabilities and threats

The Search Analytics for WP WordPress plugin up to version 1.4.16 is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. This vulnerability arises from missing or incorrect nonce validation in the process_bulk_action() function, allowing an attacker to trick an authenticated user with access to the plugin's dashboard into deleting arbitrary search-term records and associated search history via a forged request.

The WP Search Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.