27 matches found
EUVD-2023-45124
Malicious code in bioql PyPI...
EUVD-2022-32333
Malicious code in bioql PyPI...
DRUPAL-CONTRIB-2025-107
This module integrates Plausible Analytics on a site. The module did not properly filter output in certain cases. This vulnerability is mitigated by the fact that an attacker must have permission to add raw HTML to the website, such as an unfiltered WYSIWYG field on a public-facing comment...
Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107
This module integrates Plausible Analytics on a site. The module did not properly filter output in certain cases. This vulnerability is mitigated by the fact that an attacker must have permission to add raw HTML to the website, such as an unfiltered WYSIWYG field on a public-facing comment...
CVE-2023-40553
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Plausible.Io Plausible Analytics plugin = 1.3.3 versions...
CVE-2023-40553 WordPress Plausible Analytics Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Plausible.Io Plausible Analytics plugin = 1.3.3 versions...
CVE-2023-40553 WordPress Plausible Analytics Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Plausible.Io Plausible Analytics plugin = 1.3.3 versions...
CVE-2023-40553
CVE-2023-40553 affects Plausible Analytics WordPress plugin, buggy in <= 1.3.3. Unauth. Reflected XSS via page-url was reported; patch 1.3.4 fixes the flaw. Impact is reflected XSS leading to potential user impersonation or session manipulation in exposed contexts. Product: Plausible Analytics...
WordPress plugin Plausible Analytics cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...
Plausible Analytics < 1.3.4 - Reflected XSS
Description The plugin does not sanitise and escape the page-url parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
PT-2023-27506
Name of the Vulnerable Software and Affected Versions Plausible Analytics plugin versions 1.3.3 and earlier Description The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to...
CVE-2023-40553: Improper Neutralization of Input During Web Page Generation
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Plausible.Io Plausible Analytics plugin = 1.3.3 versions...
WordPress Plausible Analytics Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)
Software Plausible Analytics Type Plugin Vulnerable versions = 1.3.3 Fixed in 1.3.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-40553 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID 43b128dd161b Credits Le Ngoc Anh Required privile...
Plausible Analytics < 1.2.4 - Subscriber+ Arbitrary Settings Update
The plugin has a flawed logic when checking for authorisation and CSRF before updating its settings, allowing any authenticated users, such as subscriber, to update the plugin's settings. The attack is also possible via CSRF against any authenticated user. POST /wp-admin/admin-ajax.php HTTP/1.1...
Plausible Analytics < 1.2.4 - Subscriber+ Arbitrary Settings Update
The plugin has a flawed logic when checking for authorisation and CSRF before updating its settings, allowing any authenticated users, such as subscriber, to update the plugin's settings. The attack is also possible via CSRF against any authenticated user. PoC POST /wp-admin/admin-ajax.php HTTP/1...
WordPress Plausible Analytics plugin <= 1.2.3 - Authenticated Arbitrary Settings Update vulnerability
Authenticated Arbitrary Settings Update vulnerability discovered by Ankur Modi in WordPress Plausible Analytics plugin versions = 1.2.3. Solution Update the WordPress Plausible Analytics plugin to the latest available version at least 1.2.4...
CVE-2022-27845
Authenticated admin or higher user role Stored Cross-Site Scripting XSS in PlausibleHQ Plausible Analytics WordPress plugin = 1.2.2...
Cross site scripting
Authenticated admin or higher user role Stored Cross-Site Scripting XSS in PlausibleHQ Plausible Analytics WordPress plugin = 1.2.2...
CVE-2022-27845 WordPress Plausible Analytics plugin <= 1.2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated admin or higher user role Stored Cross-Site Scripting XSS in PlausibleHQ Plausible Analytics WordPress plugin = 1.2.2...
CVE-2022-27845 WordPress Plausible Analytics plugin <= 1.2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated admin or higher user role Stored Cross-Site Scripting XSS in PlausibleHQ Plausible Analytics WordPress plugin = 1.2.2...