CVE-2022-3904 — MonsterInsights < 8.9.1 - Stored Cross-Site Scripting via Google Analytics
The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrar…
Published: 2023-01-16 · CVSS: 6.1 · CVSS 3.1
The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7