---
id: "CVE-2026-111820"
kind: "vulnerability"
aliases: ["CVE-2026-111820"]
title: "WordPress Analytics Insights plugin: stored XSS via page title"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugins"]
not_affected_if: ["plugin-not-installed", "plugin-version-above-6.3.12"]
published_at: "2026-10-27T06:17:23+00:00"
first_seen_at: "2026-10-27T06:25:21+00:00"
updated_at: "2026-10-27T06:26:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111820", "first_seen_at": "2026-10-27T06:25:21+00:00"}]
---

# WordPress Analytics Insights plugin: stored XSS via page title

The Analytics Insights Google Analytics dashboard plugin for WordPress does not sanitize or escape the Page Title input in versions up to and including 6.3.12. An unauthenticated attacker can inject scripts that run in the browser of any user who opens the injected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get analytics-insights --field=version` if WP-CLI is available (plugin slug unknown from sources, verify it)
- Compare the installed version against `6.3.12`; anything at or below it is in scope

## Fix

- Update the Analytics Insights – Google Analytics Dashboard for WordPress plugin to a version later than `6.3.12` (exact fixed version unknown from sources)
- If no fixed version is available, deactivate the plugin until one is

## Timeline

- 2026-10-27T06:25:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111820

## From the sources

The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_