The Independent Analytics Pro plugin for WordPress has a flaw that allows an attacker to store malicious script code in the site’s database through the utm_campaign field. When a visitor later loads a page that includes the injected data, the browser will execute the script, giving the attacker the ability to run arbitrary client‑side code, steal session cookies, deface content, or redirect users. The vulnerability is a classic unsanitized input and output problem (CWE‑79), leading to a moderate severity risk.

All releases of Independent Analytics Pro up to and including version 2.15.5 are affected. The attack requires the free build to be inactive, as the free edition clears campaign parameters. Only the paid build is vulnerable.

The CVSS score of 7.2 indicates a moderate risk. No exploitation data is available in the EPSS model and the flaw is not listed in the CISA KEV catalog. The attack vector is unauthenticated; an attacker does not need any privileges on the site. Exploitation requires the plugin to be active and entails first visiting a front‑end page to obtain a server‑signed payload that can later be replayed against the unauthenticated /iawp/search REST endpoint, as the signature check does not cover utm_* parameters. With these conditions met, an attacker can easily insert malicious scripts and compromise any user who views the affected content.