{"id":"CVE-2026-104744","kind":"vulnerability","aliases":["CVE-2026-104744"],"related":[],"title":"WordPress Independent Analytics Pro: unauthenticated stored XSS via utm_campaign","description":"The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Independent Analytics Pro build to be active, as the free build nulls campaign parameters; additionally, the attacker must first visit a frontend page to obtain a server-signed payload that can be replayed with a crafted utm_campaign value against the unauthenticated /iawp/search REST endpoint, since the signature check does not cover utm_* fields.","summary":"The Independent Analytics Pro WordPress plugin stores the utm_campaign parameter without sanitizing or escaping it, so an unauthenticated visitor can inject scripts. Those scripts run in the browser of any user who opens the affected analytics page, which can let an attacker act as that user.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["independent-analytics-pro","package","self-hosted","wordpress"],"not_affected_if":["free-build","plugin-not-installed","version-above-2.15.5"],"how_to_check":"- Check whether the Independent Analytics Pro plugin is installed and active on the WordPress site, and which version it runs.\n- Confirm the paid (Pro) build is in use; the sources say the free build nulls campaign parameters and is not exploitable this way.\n- Check the plugin version against the affected range (up to and including `2.15.5`).","fix":"- Independent Analytics Pro: move to a version newer than `2.15.5` (the fixed version is not named in the sources).","status":"open","published_at":"2026-10-30T18:17:15+00:00","first_seen_at":"2026-10-30T18:55:28+00:00","triaged_at":"2026-10-30T18:56:54+00:00","updated_at":"2026-10-30T18:56:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T18:56:54Z","model":"claude-haiku-5-5","output":{"fix":"- Independent Analytics Pro: move to a version newer than `2.15.5` (the fixed version is not named in the sources).","reach":"internet","title":"WordPress Independent Analytics Pro: unauthenticated stored XSS via utm_campaign","impact":"medium","summary":"The Independent Analytics Pro WordPress plugin stores the utm_campaign parameter without sanitizing or escaping it, so an unauthenticated visitor can inject scripts. Those scripts run in the browser of any user who opens the affected analytics page, which can let an attacker act as that user.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","independent-analytics-pro","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Injected scripts run in logged-in admins' browsers on the analytics page.","analyst_note":"","how_to_check":"- Check whether the Independent Analytics Pro plugin is installed and active on the WordPress site, and which version it runs.\n- Confirm the paid (Pro) build is in use; the sources say the free build nulls campaign parameters and is not exploitable this way.\n- Check the plugin version against the affected range (up to and including `2.15.5`).","plain_action":"","needs_analyst":false,"not_affected_if":["free-build","plugin-not-installed","version-above-2.15.5"],"who_is_affected":"Sites running the paid Independent Analytics Pro WordPress plugin at version 2.15.5 or older are exposed. The free build is reported not to store campaign parameters, so it is not exploitable this way. Exploitation needs a replayable server-signed payload from a frontend page visit, which the sources describe as a prerequisite step, not a login.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4284,"output_tokens":645,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104744':13A,16A '-2026':12A,15A '/iawp/search':179C '2.15.5':100C 'access':129C 'act':69B 'activ':142C 'addit':150C 'affect':61B 'analyt':3A,19B,28B,62B,75C,137C 'arbitrari':118C 'attack':68B,115C,152C 'browser':54B 'build':139C,146C 'campaign':10A,35B,91C,148C,174C 'check':185C 'cover':188C 'craft':172C 'cross':85C 'cross-sit':84C 'cve':11A,14A 'due':101C 'endpoint':181C 'escap':40B,108C 'execut':125C 'exploit':133C 'field':190C 'first':154C 'free':145C 'frontend':157C 'host':24B 'includ':99C 'independ':2A,18B,27B,74C,136C 'independent-analytics-pro':17B 'inject':47B,117C,131C 'input':104C 'insuffici':103C 'let':66B 'make':110C 'must':153C 'null':147C 'obtain':160C 'open':59B 'output':107C 'packag':21B 'page':63B,122C,132C,158C 'paramet':36B,92C,149C 'payload':165C 'plugin':31B,77C 'possibl':112C 'pro':4A,20B,29B,76C,138C 'replay':169C 'requir':134C 'rest':180C 'run':51B 'sanit':38B,105C 'script':48B,50B,87C,120C 'self':23B 'self-host':22B 'server':163C 'server-sign':162C 'sign':164C 'signatur':184C 'sinc':182C 'site':86C 'store':6A,32B,83C 'unauthent':5A,44B,114C,178C 'user':57B,72B,128C 'utm':9A,34B,90C,173C,189C 'valu':175C 'version':95C 'via':8A,88C 'visit':155C 'visitor':45B 'vulner':81C 'web':119C 'whenev':126C 'without':37B 'wordpress':1A,25B,30B,79C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running the paid Independent Analytics Pro WordPress plugin at version 2.15.5 or older are exposed. The free build is reported not to store campaign parameters, so it is not exploitable this way. Exploitation needs a replayable server-signed payload from a frontend page visit, which the sources describe as a prerequisite step, not a login.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104744","severity":null,"published_at":"2026-10-30T18:17:15+00:00","modified_at":"2026-10-30T18:33:26+00:00","first_seen_at":"2026-10-30T18:55:28+00:00","fetched_at":"2026-10-30T18:55:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}