Unknown Monsterinsights vulnerabilities
3 vulnerabilities
Known vulnerabilities in Unknown Monsterinsights, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2022-3904monsterinsights +2 moreMonsterInsights < 8.9.1 - Stored Cross-Site Scripting via Google AnalyticsThe MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.EPSS1.34%MediumCVE-2026-11366unknown · monsterinsights +1 moreMonsterInsights < 11.1.0 - Unauthenticated Measurement Protocol Secret Update via Empty-Key HMAC BypassThe MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers forge a valid signature and overwrite a MonsterInsights WordPress plugin before 11.1.0 configuration value, disrupting the MonsterInsights WordPress plugin before 11.1.0's server-side analytics in Manual GA4 mode.EPSS0.25%MediumCVE-2023-0081monsterinsights +2 moreMonsterInsights < 8.12.1 - Contributor+ Stored XSSThe MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.EPSS0.59%