Stored Cross-Site Scripting in Independent Analytics Plugin for WordPress

The Independent Analytics plugin for WordPress (versions 2.15.0 and earlier) contains a high-severity Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-17506. The vulnerability stems from improper sanitization logic within the plugin's reporting functionality. Specifically, the get_cell_content() function applies a urldecode() operation after the initial esc_url() sanitization. This sequence permits percent-encoded HTML tags to bypass URL validation filters. Once decoded, the raw markup is rendered within the plugin's admin reporting interface.

The flaw is exacerbated by the plugin's public REST endpoint, /iawp/search, which accepts unauthenticated requests. An attacker can leverage this to inject malicious payloads into the 404 tracking parameter. Because wp_kses_post() filtering allows certain img elements and data-* attributes, malicious payloads can persist in the database. When an administrator or authenticated user views the 404 report page, the injected script executes in their browser, potentially leading to unauthorized actions or credential theft.

Impact

Successful exploitation allows unauthenticated attackers to inject persistent malicious scripts into the WordPress site's reporting dashboard. This primarily threatens administrative accounts viewing the 404 URL column within the Independent Analytics plugin. Impact includes potential session hijacking, unauthorized administrative actions, and redirection of site users, affecting any WordPress installation using the vulnerable versions of this plugin.

Recommendation

• Update the Independent Analytics plugin to the latest version immediately to remediate CVE-2026-17506.
• Audit access logs for anomalous POST requests directed at the /iawp/search endpoint.
• Deploy web application firewall (WAF) rules to inspect the 'not_found_url' parameter for percent-encoded HTML characters or suspicious JavaScript patterns.
• Restrict access to WordPress administrative dashboards and sensitive REST API endpoints to trusted IP addresses.