Matomo Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in Matomo Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from n/a through 5.1.1.

Affected:

up to 5.1.2

Fixed in:

5.1.2

Disclosed:

Jan 2, 2025

CVE-2024-38766 on NVD →

The Matomo Analytics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to dismiss notices via a forged request granted they can trick a site ad...

CVSS:

4.3

Affected:

up to 5.1.0

Fixed in:

5.1.1

Disclosed:

Jul 12, 2024

CVE-2024-38766 on NVD →

[en] The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inj...

Affected:

up to 5.0.1

Fixed in:

5.0.1

Disclosed:

Feb 20, 2024

CVE-2023-6923 on NVD →

The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject a...

CVSS:

6.1

Affected:

up to 4.15.3

Fixed in:

5.0.1

Disclosed:

Feb 7, 2024

CVE-2023-6923 on NVD →