The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.
History

Tue, 08 Apr 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2025-04-08T19:34:28.248Z

Reserved: 2022-11-09T01:13:06.559Z

Link: CVE-2022-3904

cve-icon Vulnrichment

Updated: 2024-08-03T01:20:58.788Z

cve-icon NVD

Status : Modified

Published: 2023-01-16T16:15:10.783

Modified: 2025-04-08T20:15:16.833

Link: CVE-2022-3904

cve-icon Redhat

No data.