Plausible Analytics Vulnerabilities

The Plausible Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page-url parameter in versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that e...

CVSS:

6.1

Affected:

up to 1.3.3

Fixed in:

1.3.4

Disclosed:

Aug 16, 2023

CVE-2023-40553 on NVD →

The Plausible Analytics plugin is vulnerable to unauthorized setting changes in versions up to, and including, 1.2.3 due to an improperly configured capability and nonce check on the save_admin_settings() function. This could be exploited by any authenticated user, including those with minimal capabilities like subscri...

CVSS:

6.3

Affected:

up to 1.2.3

Fixed in:

1.2.4

Disclosed:

May 27, 2022

Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) in PlausibleHQ Plausible Analytics (WordPress plugin) <= 1.2.2

CVSS:

4.8

Affected:

up to 1.2.2

Fixed in:

1.2.3

Disclosed:

Apr 7, 2022

CVE-2022-27845 on NVD →