Googleanalytics Vulnerabilities

[en] The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.4. This is due to the Google Analytics client_ID and client_secret being stored in plaintext in the publicly visible plugin source. This can allow unauthentica...

Affected:

up to 3.2.4

Fix:

No patched version reported

Disclosed:

Jan 7, 2026

CVE-2025-12540 on NVD →

The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.4. This is due to the Google Analytics client_ID and client_secret being stored in plaintext in the publicly visible plugin source. This can allow unauthenticated a...

CVSS:

4.7

Affected:

up to 3.2.4

Fix:

No patched version reported

Disclosed:

Jan 6, 2026

CVE-2025-12540 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in ShareThis ShareThis Dashboard for Google Analytics. This issue affects ShareThis Dashboard for Google Analytics: from n/a through 3.2.2.

Affected:

up to 3.2.3

Fix:

No patched version reported

Disclosed:

Apr 10, 2025

CVE-2025-32282 on NVD →

The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted th...

CVSS:

4.3

Affected:

up to 3.2.3

Fixed in:

3.2.4

Disclosed:

Apr 4, 2025

CVE-2025-32282 on NVD →

The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_actions() function in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to disable all features.

CVSS:

5.3

Affected:

up to 3.2.1

Fixed in:

3.2.2

Disclosed:

Mar 13, 2025

CVE-2025-1507 on NVD →

[en] Missing Authorization vulnerability in ShareThis ShareThis Dashboard for Google Analytics.This issue affects ShareThis Dashboard for Google Analytics: from n/a through 3.1.4.

Affected:

up to 3.1.5

Fixed in:

3.1.5

Disclosed:

Mar 25, 2024

CVE-2022-45851 on NVD →

The ShareThis Dashboard plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on one of its functions in versions up to, and including, 3.1.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and change plugin...

CVSS:

5.4

Affected:

up to 3.1.4

Fixed in:

3.1.5

Disclosed:

Nov 23, 2022

CVE-2022-45851 on NVD →

[en] The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be ex...

Affected:

up to 2.5.2

Fixed in:

2.5.2

Disclosed:

Aug 30, 2021

CVE-2021-24438 on NVD →

The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be execute...

CVSS:

6.1

Affected:

up to 2.5.2

Fixed in:

2.5.2

Disclosed:

Aug 2, 2021

CVE-2021-24438 on NVD →

Affected:

up to 3.2.2

Fixed in:

3.2.2

CVE-2025-1507 on NVD →