{"id":"CVE-2026-111820","kind":"vulnerability","aliases":["CVE-2026-111820"],"related":[],"title":"WordPress Analytics Insights plugin: stored XSS via page title","description":"The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The Analytics Insights Google Analytics dashboard plugin for WordPress does not sanitize or escape the Page Title input in versions up to and including 6.3.12. An unauthenticated attacker can inject scripts that run in the browser of any user who opens the injected page.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["plugin-not-installed","plugin-version-above-6.3.12"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get analytics-insights --field=version` if WP-CLI is available (plugin slug unknown from sources, verify it)\n- Compare the installed version against `6.3.12`; anything at or below it is in scope","fix":"- Update the Analytics Insights – Google Analytics Dashboard for WordPress plugin to a version later than `6.3.12` (exact fixed version unknown from sources)\n- If no fixed version is available, deactivate the plugin until one is","status":"open","published_at":"2026-10-27T06:17:23+00:00","first_seen_at":"2026-10-27T06:25:21+00:00","triaged_at":"2026-10-27T06:26:20+00:00","updated_at":"2026-10-27T06:26:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T06:26:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Analytics Insights – Google Analytics Dashboard for WordPress plugin to a version later than `6.3.12` (exact fixed version unknown from sources)\n- If no fixed version is available, deactivate the plugin until one is","reach":"internet","title":"WordPress Analytics Insights plugin: stored XSS via page title","impact":"medium","summary":"The Analytics Insights Google Analytics dashboard plugin for WordPress does not sanitize or escape the Page Title input in versions up to and including 6.3.12. An unauthenticated attacker can inject scripts that run in the browser of any user who opens the injected page.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker scripts run in visitors' and admins' browsers on the site","analyst_note":"Confirm the fixed plugin version and exact plugin slug from the NVD entry or the WordPress plugin changelog (https://nvd.nist.gov/vuln/detail/CVE-2026-111820).","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get analytics-insights --field=version` if WP-CLI is available (plugin slug unknown from sources, verify it)\n- Compare the installed version against `6.3.12`; anything at or below it is in scope","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-6.3.12"],"who_is_affected":"Sites running the Analytics Insights Google Analytics Dashboard plugin at version 6.3.12 or earlier are exposed. The flaw is in how the page title is stored and output, so the risk is greatest on sites where the plugin's page title data is shown to logged-in administrators. Sites without this plugin installed are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":3364,"output_tokens":691,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111820':12A,15A '-2026':11A,14A '6.3.12':48B,98C 'access':127C 'analyt':2A,25B,28B,69C,72C 'arbitrari':116C 'attack':51B,113C 'browser':59B 'cross':84C 'cross-sit':83C 'cve':10A,13A 'dashboard':29B,73C 'due':99C 'escap':37B,106C 'execut':123C 'googl':27B,71C 'host':19B 'includ':47B,97C 'inject':53B,66B,115C,129C 'input':41B,102C 'insight':3A,26B,70C 'insuffici':101C 'make':108C 'open':64B 'output':105C 'packag':16B 'page':8A,39B,67B,89C,120C,130C 'plugin':4A,23B,30B,76C 'possibl':110C 'run':56B 'sanit':35B,103C 'script':54B,86C,118C 'self':18B 'self-host':17B 'site':85C 'store':5A,82C 'titl':9A,40B,90C 'unauthent':50B,112C 'user':62B,126C 'version':43B,93C 'via':7A,87C 'vulner':80C 'web':117C 'whenev':124C 'wordpress':1A,20B,22B,32B,75C,78C 'wordpress-plugin':21B 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Analytics Insights Google Analytics Dashboard plugin at version 6.3.12 or earlier are exposed. The flaw is in how the page title is stored and output, so the risk is greatest on sites where the plugin's page title data is shown to logged-in administrators. Sites without this plugin installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T06:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111820","severity":null,"published_at":"2026-10-27T06:17:23+00:00","modified_at":"2026-10-27T06:17:23+00:00","first_seen_at":"2026-10-27T06:25:21+00:00","fetched_at":"2026-10-27T06:25:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}