SZB-07791b5eb1
EUVD flags stored cross-site scripting in Independent Analytics Pro up to 2.15.5 (CVSS 7.2)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Independent Analytics
- Product
- Independent Analytics Pro
- First seen
Summary
The EUVD (ENISA) database has published EUVD-2026-114231 for Independent Analytics Pro, versions up to and including 2.15.5. The entry says the utm_campaign parameter is not sanitized, enabling stored cross-site scripting.
If you use Independent Analytics
Update Independent Analytics Pro to a version newer than 2.15.5
Review stored analytics campaign data for injected scripts
Limit access to the analytics dashboard to trusted admin users
What the sources say 1
· Mastodon: “The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 2.15.5” Source