The Independent Analytics plugin for WordPress is susceptible to stored cross‑site scripting due to the 404 not_found_url tracking parameter in versions up to and including 2.15.0. The get_cell_content() function applies urldecode() after esc_url(), allowing percent‑encoded HTML to bypass URL validation and be rendered as raw markup. Because wp_kses_post() preserves img elements and data‑* attributes, malicious payloads survive the sanitisation process. A public REST endpoint (/iawp/search) accepts unauthenticated requests as long as they include a signature embedded in page HTML, enabling an attacker to inject JavaScript that is stored and later executed when a visitor opens an injected page.

The affected product is the Independent Analytics plugin for WordPress by bensibley. All releases up to and including 2.15.0 are vulnerable; newer releases are not affected.

The vulnerability carries a CVSS score of 7.2 and is not listed in the CISA KEV catalog. With no EPSS score available, the exploitation probability is unclear but the presence of an unauthenticated REST interface and the possibility to supply a signature from public page HTML suggest a realistic attack path. Exploit would result in client‑side script execution for any user who visits a page containing the injected payload, potentially compromising session data or defacing content.