WordPress Yoast Google Analytics 5.3.2 Cross Site Scripting

`Stored XSS Vulnerability in Google Analytics by Yoast Wordpress Plugin  
  
. contents:: Table Of Content  
  
Overview  
  
Title :Stored XSS Vulnerability in Google Analytics by Yoast Wordpress Plugin  
Author: Kaustubh G. Padwad, Rohit Kumar.  
Plugin Homepage: https://yoast.com/wordpress/plugins/google-analytics/  
Severity: Medium  
Version Affected: Version 5.3.2 and mostly prior to it  
Version Tested : Version 5.3.2  
version patched:  
Description  
  
Vulnerable Parameter  
  
Current UA-Profile  
Manually enter your UA code  
Label for those links  
Set path for internal links to track as outbound links:  
Subdomain tracking:  
Extensions of files to track as downloads:  
About Vulnerability  
  
This plugin is vulnerable to a Stored Cross Site Scripting vulnerability,This issue was exploited when administrator users with access to "Google Analytics by Yoast" Setting in wordpress above listed vulnerable parameter is vulnerable for stored XSS. A malicious administration can hijack other users session, take control of another administrator's browser or install malware on their computer.  
  
Vulnerability Class  
  
Cross Site Scripting (https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS)  
  
Steps to Reproduce: (POC)  
  
After installing the plugin  
  
Goto settings --> Google Analytics by Yoast  
  
Input this payload in "Manually enter your UA code" :- v style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)" onclick="alert(1)">x  
  
Click on the Save Changes button and navigate your cursor to input box,you will see XSS in action  
Reload the page or re navigate to page to make sure its stored ;)  
Mitigation  
  
https://github.com/Yoast/google-analytics-for-wordpress/pull/322/commits  
  
Change Log  
  
https://github.com/Yoast/google-analytics-for-wordpress/pull/322/commits  
  
Disclosure  
  
22-February-2015 Reported to developer  
25-February-2015 Fixed by developer  
05-March-2015 Issue Closed with team.  
06-March-2015 Public Discloser  
  
credits  
  
Kaustubh Padwad & Rohit Kumar  
Information Security Researcher  
[email protected] & [email protected]  
@s3curityb3ast,@rkumars3c  
http://breakthesec.com  
https://www.linkedin.com/in/kaustubhpadwad  
`