Live › vulnerability › CVE-2026-104744
The Independent Analytics Pro WordPress plugin stores the utm_campaign parameter without sanitizing or escaping it, so an unauthenticated visitor can inject scripts. Those scripts run in the browser of any user who opens the affected analytics page, which can let an attacker act as that user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running the paid Independent Analytics Pro WordPress plugin at version 2.15.5 or older are exposed. The free build is reported not to store campaign parameters, so it is not exploitable this way. Exploitation needs a replayable server-signed payload from a frontend page visit, which the sources describe as a prerequisite step, not a login.
No product ranges from the sources yet.
2.15.5).2.15.5 (the fixed version is not named in the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Independent Analytics Pro build to be active, as the free build nulls campaign parameters; additionally, the attacker must first visit a frontend page to obtain a server-signed payload that can be replayed with a crafted utm_campaign value against the unauthenticated /iawp/search REST endpoint, since the signature check does not cover utm_* fields.
This page as .md · .json · in your agent: get_signal("CVE-2026-104744")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.