CVE-2025-48097: WordPress WSAnalytics plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The CVSS vector indicates that exploitation can be performed remotely without authentication or special privileges, but it requires user interaction. An attacker would need to cause a user to access a crafted request or page.

Q: What versions are affected?

WSAnalytics versions through 1.1.2 are affected. The available data does not identify a fixed version.

Q: What is the potential impact if exploitation succeeds?

The vulnerability is a reflected XSS issue with scope changed and low confidentiality, integrity, and availability impact in the supplied CVSS vector. Successful exploitation could execute attacker-controlled script in the context of a user who interacts with the crafted content.

Published Oct 22, 2025

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiva WSAnalytics wsanalytics-google-analytics-and-dashboards allows Reflected XSS.This issue affects WSAnalytics: from n/a through <= 1.1.2.

Affected Software

2 affected components

Shiva WSAnalytics<=1.1.2

WordPress WSAnalytics<=1.1.2

Event History

Oct 22, 2025

CVE Published

via MITRE·02:32 PM

Data Sourced

via MITRE·02:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates that exploitation can be performed remotely without authentication or special privileges, but it requires user interaction. An attacker would need to cause a user to access a crafted request or page.

What versions are affected?

WSAnalytics versions through 1.1.2 are affected. The available data does not identify a fixed version.

What is the potential impact if exploitation succeeds?

The vulnerability is a reflected XSS issue with scope changed and low confidentiality, integrity, and availability impact in the supplied CVSS vector. Successful exploitation could execute attacker-controlled script in the context of a user who interacts with the crafted content.

CVE-2025-48097: WordPress WSAnalytics plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What versions are affected?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What versions are affected?

What is the potential impact if exploitation succeeds?