CVE-2026-17506: Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting
The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent() function applying urldecode() after escurl() when rendering the URL column for 404 entries — a sequence that allows percent-encoded HTML to pass URL validation and then be reconstructed as raw markup, which wpksespost() does not strip because it retains img elements and data- attributes, and because the public REST endpoint /iawp/search accepts unauthenticated requests as long as they carry a signature that is itself embedded in public page HTML. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Independent Analytics pluginto a version that resolves this vulnerability.Fixed in 2.15.0 - Compensating control
Use the Independent Analytics public REST endpoint (/iawp/search) only if required; otherwise restrict external access so unauthenticated requests cannot reach it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17506?
CVE-2026-17506 has a high severity score of 7.2.
What type of vulnerability is CVE-2026-17506?
CVE-2026-17506 is an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability.
Which versions of the Independent Analytics plugin are affected by CVE-2026-17506?
CVE-2026-17506 affects Independent Analytics plugin versions up to and including 2.15.0.
How do I fix CVE-2026-17506?
To fix CVE-2026-17506, update the Independent Analytics plugin to the latest version.
What impact does CVE-2026-17506 have on WordPress sites?
CVE-2026-17506 could allow attackers to execute malicious scripts in the context of an authenticated user session.