Site Kit by Google – Analytics, Search Console, AdSense, Speed < 1.176.0 - Missing Authorization to Authenticated (Editor+) Settings Update
low
The Site Kit by Google – Analytics, Search Console, AdSense, Speed plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 1.176.0 (exclusive). This makes it possible for authenticated attackers, with Editor-level access and above, to perform an un...
- CVSS:
- 2.7
- Affected:
- up to 1.176.0
- Fixed in:
- 1.176.0
- Disclosed:
- Jun 25, 2026
CVE-2026-10753 on NVD →
Site Kit by Google <= 1.7.1 - Sensitive Information Disclosure
medium
The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.7.1. This is due to the lack of capability checks on the admin_enqueue_scripts action which displays the connection key. This makes it possible for authenticated attackers with any level of...
- CVSS:
- 4.3
- Affected:
- up to 1.7.1
- Fixed in:
- 1.8.0
- Disclosed:
- May 21, 2020
CVE-2020-8934 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database