Live › vulnerability › CVE-2026-111820
Go to dashboardThe Analytics Insights Google Analytics dashboard plugin for WordPress does not sanitize or escape the Page Title input in versions up to and including 6.3.12. An unauthenticated attacker can inject scripts that run in the browser of any user who opens the injected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 06:25 UTC. All times on this page are UTC.
Sites running the Analytics Insights Google Analytics Dashboard plugin at version 6.3.12 or earlier are exposed. The flaw is in how the page title is stored and output, so the risk is greatest on sites where the plugin's page title data is shown to logged-in administrators. Sites without this plugin installed are not affected.
No product ranges from the sources yet.
wp plugin get analytics-insights --field=version if WP-CLI is available (plugin slug unknown from sources, verify it)6.3.12; anything at or below it is in scope6.3.12 (exact fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
This page as .md · .json · in your agent: get_signal("CVE-2026-111820")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.