Ht Easy Google Analytics Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes HT Easy GA4 ( Google Analytics 4 ) allows Stored XSS.This issue affects HT Easy GA4 ( Google Analytics 4 ): from n/a through 1.1.7.

Affected:

up to 1.1.8

Fixed in:

1.1.8

Disclosed:

Mar 19, 2024

CVE-2024-29094 on NVD →

The HT Easy GA4 ( Google Analytics 4 ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘[function_or_param]’ parameter in versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVSS:

6.1

Affected:

up to 1.1.7

Fixed in:

1.1.8

Disclosed:

Mar 15, 2024

CVE-2024-29094 on NVD →

[en] The HT Easy GA4 – Google Analytics WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the login() function in all versions up to, and including, 1.1.5. This makes it possible for unauthenticated attackers to update the email associated thro...

Affected:

up to 1.2.0

Fixed in:

1.2.0

Disclosed:

Mar 13, 2024

CVE-2024-1176 on NVD →

The HT Easy GA4 – Google Analytics WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the login() function in all versions up to, and including, 1.1.5. This makes it possible for unauthenticated attackers to update the email associated through t...

CVSS:

5.3

Affected:

up to 1.1.5

Fixed in:

1.2.0

Disclosed:

Mar 8, 2024

CVE-2024-1176 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Easy GA4 ( Google Analytics 4 ) plugin <= 1.0.6 versions.

Affected:

up to 1.0.7

Fixed in:

1.0.7

Disclosed:

Jun 15, 2023

CVE-2023-23802 on NVD →

The HT Easy GA4 ( Google Analytics 4 ) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the plugin_activation function. This makes it possible for unauthenticated attackers to activate plugins via a forged r...

CVSS:

5.4

Affected:

up to 1.0.6

Fixed in:

1.0.7

Disclosed:

Mar 8, 2023

CVE-2023-23802 on NVD →