The Analytics Cat plugin for WordPress fails to neutralize user input before inserting it into the HTML output. This flaw allows an attacker to insert arbitrary script code that will be executed in the browsers of visitors who load the affected page, resulting in client-side code execution.

WordPress sites that have the fatcatapps Analytics Cat plugin installed in any version up to and including 1.1.2.

The CVSS score of 7.1 indicates a moderate to high severity. The EPSS score of less than 1% suggests that exploit attempts are currently uncommon. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the flaw by including malicious script content in a URL parameter or form field; no server‑side privileges are required, and the attack can be performed remotely against any site that has the vulnerable plugin.