WP Meta SEO < 4.5.4 - Subscriber+ Google Analytics Settings Update

The plugin does not have authorisation check when updating its Google Analytics settings, which could allow any authenticated users, such as subscriber to update them...

WordPress Easy Google Analytics for WordPress Plugin <= 1.6.0 is vulnerable to Broken Access Control

Software Easy Google Analytics for WordPress Type Plugin Vulnerable versions = 1.6.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23887 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 682fb3f4795d Credits Mika Requir...

SUSE CVE-2016-7401

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies...

Opt-Out for Google Analytics < 2.3.5 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Opt-Out for Google Analytics Plugin <= 2.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Opt-Out for Google Analytics Type Plugin Vulnerable versions = 2.3.4 Fixed in 2.3.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25712 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2387d8d69039 Credits Rio Darmaw...

Malicious code in @superbet-group/martech.lib.google-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 623842b7ea3cf0abe8ef8b80d5eed291e97bcc42d9ad072da19aca5c6d3d456c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-59 Malicious code in @superbet-group/martech.lib.google-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 623842b7ea3cf0abe8ef8b80d5eed291e97bcc42d9ad072da19aca5c6d3d456c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

pixiv: Stealing Users OAuth authorization code via redirect_uri

A path traversal vulnerability in the OAuth redirecturi parameter allowed attackers to redirect authenticated users to their product page with their OAuth credentials, potentially leading to account takeover. This could occur due to the leakage of the user's authorization code via the query strin...

WordPress MainWP Google Analytics Extension Plugin <= 4.0.4 is vulnerable to SQL Injection

Software MainWP Google Analytics Extension Type Plugin Vulnerable versions = 4.0.4 Fixed in 4.0.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-23651 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 8c3984a0a5c8 Credits Dave Jong Patchstack Required...

CVE-2022-3904

The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics...

Code injection

The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics...

CVE-2022-3904 MonsterInsights < 8.9.1 - Stored Cross-Site Scripting via Google Analytics

The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics...

CVE-2022-3904 MonsterInsights < 8.9.1 - Stored Cross-Site Scripting via Google Analytics

The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics...

WordPress Google Analytics by Monster Insights Plugin < 8.12.1 is vulnerable to Cross Site Scripting (XSS)

Software Google Analytics by Monster Insights Type Plugin Vulnerable versions 8.12.1 Fixed in 8.12.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0081 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 30ac1c972f6b Credi...

CVE-2017-20155

A vulnerability was found in Sterc Google Analytics Dashboard for MODX up to 1.0.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file core/components/analyticsdashboardwidget/elements/tpl/widget.analytics.tpl of the component Internal...

CVE-2017-20155

A vulnerability was found in Sterc Google Analytics Dashboard for MODX up to 1.0.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file core/components/analyticsdashboardwidget/elements/tpl/widget.analytics.tpl of the component Internal...

Cross site scripting

A vulnerability was found in Sterc Google Analytics Dashboard for MODX up to 1.0.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file core/components/analyticsdashboardwidget/elements/tpl/widget.analytics.tpl of the component Internal...

CVE-2017-20155 Sterc Google Analytics Dashboard for MODX Internal Search widget.analytics.tpl cross site scripting

A vulnerability was found in Sterc Google Analytics Dashboard for MODX up to 1.0.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file core/components/analyticsdashboardwidget/elements/tpl/widget.analytics.tpl of the component Internal...

CVE-2017-20155

CVE-2017-20155 affects Sterc Google Analytics Dashboard for MODX up to 1.0.5. The vulnerability resides in the Internal Search widget: file core/components/analyticsdashboardwidget/elements/tpl/widget.analytics.tpl, enabling cross-site scripting. An attacker can exploit it remotely. A fix is avai...

PT-2022-8020 · Modx · Sterc Google Analytics Dashboard For Modx

Name of the Vulnerable Software and Affected Versions: Sterc Google Analytics Dashboard for MODX versions up to 1.0.5 Description: A vulnerability was found in the Sterc Google Analytics Dashboard for MODX, affecting an unknown functionality of the file...