EUVD-2026-53339

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

CVE-2026-17506 Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

PT-2026-68170

Name of the Vulnerable Software and Affected Versions Independent Analytics plugin for WordPress versions prior to 2.15.1 Description Stored Cross-Site Scripting occurs via the not found url tracking parameter. The issue arises because the get cell content function applies urldecode after esc url...

ChurchCRM 跨站脚本漏洞

ChurchCRM is an open source CRM system for churches. A security vulnerability exists in ChurchCRM version 4.5.3, which can be exploited by attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found...