CVE-2026-103369

The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-103369

The Social Share Buttons & Analytics Plugin (GetSocial.io) for WordPress, in versions up to and including 4.5 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the response parameter via the gs_update_with_values AJ...

CVE-2026-103369 Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX

The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-100811

The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-103369 Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX

The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-103369: Improper Neutralization of Input During Web Page Generation

The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Alz in WordPress Plugin Social Share Buttons & Analytics Plugin – GetSocial.io versions = 4.5...

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io Cross-site Script Vulnerability

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io versions 4.5 and earlier have a cross-site scripting vulnerability. This vulnerability stems from improper cleaning of response parameter inputs and improper output escaping, allowing authenticated attackers to inject arbitrary web...

Malicious Package

Overview latam-xp-analytics-plugin-absmartly is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious code in latam-xp-analytics-plugin-absmartly (npm)

The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...

Malicious code in latam-xp-analytics-plugin-gtm (npm)

Source: ossf-package-analysis 333a48f2dfbcb9ab75608fb120182771732f71543d3bc13c3352b144b3022403 The OpenSSF Package Analysis project identified 'latam-xp-analytics-plugin-gtm' @ 2.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious Package

Overview latam-xp-analytics-plugin-gtm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in devplatform-spa-plugin-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22202ea28f902a0048608456e99803ff08f06d111ce97813292e2b1d018c06ec [email protected] advertises itself as an analytics library, but on require its main entry loads adapter.js which downloads a...

CVE-2026-17506

CVE-2026-17506 affects the Independent Analytics plugin for WordPress up to version 2.15.0. The vulnerability is a Stored XSS in the 404 not_found_url tracking parameter caused by get_cell_content() applying urldecode() after esc_url() when rendering the URL column for 404 entries, allowing perce...

CVE-2026-7444

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

PT-2026-68170

Name of the Vulnerable Software and Affected Versions Independent Analytics plugin for WordPress versions prior to 2.15.1 Description Stored Cross-Site Scripting occurs via the not found url tracking parameter. The issue arises because the get cell content function applies urldecode after esc url...

CVE-2026-8944

The CVE-2026-8944 affects the WordPress plugin IO Technologies’ Google Analytics plugin (versions

CVE-2025-68872 WordPress Eli's WordCents adSense Widget with Analytics plugin <= 1.3.03.27 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Elis WordCents adSense Widget with Analytics = 1.3.03.27 versions...

CVE-2025-68872

CVE-2025-68872 is a reflected XSS vulnerability in the WordPress plugin “Eli's WordCents adSense Widget with Analytics” (versions

EUVD-2026-32702

The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.14.9. This is due to a public tracking route at /wp-json/iawp/search that accepts attacker-controlled referrerurl values when the signature matches, combined with a...