---
id: "CVE-2026-104744"
kind: "vulnerability"
aliases: ["CVE-2026-104744"]
title: "WordPress Independent Analytics Pro: unauthenticated stored XSS via utm_campaign"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["independent-analytics-pro", "package", "self-hosted", "wordpress"]
not_affected_if: ["free-build", "plugin-not-installed", "version-above-2.15.5"]
published_at: "2026-10-30T18:17:15+00:00"
first_seen_at: "2026-10-30T18:55:28+00:00"
updated_at: "2026-10-30T18:56:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104744", "first_seen_at": "2026-10-30T18:55:28+00:00"}]
---

# WordPress Independent Analytics Pro: unauthenticated stored XSS via utm_campaign

The Independent Analytics Pro WordPress plugin stores the utm_campaign parameter without sanitizing or escaping it, so an unauthenticated visitor can inject scripts. Those scripts run in the browser of any user who opens the affected analytics page, which can let an attacker act as that user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Independent Analytics Pro plugin is installed and active on the WordPress site, and which version it runs.
- Confirm the paid (Pro) build is in use; the sources say the free build nulls campaign parameters and is not exploitable this way.
- Check the plugin version against the affected range (up to and including `2.15.5`).

## Fix

- Independent Analytics Pro: move to a version newer than `2.15.5` (the fixed version is not named in the sources).

## Timeline

- 2026-10-30T18:55:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104744

## From the sources

The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Independent Analytics Pro build to be active, as the free build nulls campaign parameters; additionally, the attacker must first visit a frontend page to obtain a server-signed payload that can be replayed with a crafted utm_campaign value against the unauthenticated /iawp/search REST endpoint, since the signature check does not cover utm_* fields.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_