MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy), CVE-2022-3904

CVE, Research URL: CVE-2022-3904
Home page URL: Security reports for MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
Application: MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
Published on: Jan 16, 2023
Research Description: The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.
Affected versions: Min -, max 8.9.1.
Status: vulnerable