WordPress Independent Analytics Unauth Stored XSS Vulnerability (CVE-2026-17506)

Vulnerability Overview Vulnerability Name: Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting CVE ID: CVE-2026-17506 CVSS Score: 7.2 (High) Publication Date: August 4, 2026 Last Updated: August 5, 2026 Researcher: daroo Impact Scope Software Type: Plugin Software Name: Independent Analytics Affected Versions: <= 2.15.0 Patched Version: 2.15.1 Remediation Recommendation: Update to version 2.15.1 or a newer patched version. Vulnerability Description The Independent Analytics plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in version 2.15.0 and below, specifically exploitable through the tracking parameter. This vulnerability arises because the function fails to properly decode the URL column during rendering, allowing uncoded HTML to pass URL validation and be reconstructed into raw markup. This enables unauthorized attackers to inject arbitrary web scripts into public page HTML, provided they carry a signature embedded within the public page HTML. References plugins.trac.wordpress.org Additional Information Vulnerability Details for Independent Analytics – WordPress Analytics Plugin: - Software Type: Plugin - Software Slug: independent-analytics - Patched?: Yes - Remediation: Update to version 2.15.1, or a newer patched version - Affected Version: <= 2.15.0 - Patched Version: 2.15.1 Recent vulnerabilities in Independent Analytics – WordPress Analytics Plugin: - Title: Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route - CVE ID: CVE-2026-5737 - CVSS: 6.5 - Researchers: alex_henry20 - Date: May 27, 2026 - Title: Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter - CVE ID: CVE-2024-13362 - CVSS: 6.1 - Researchers: Asal Mozes - Date: April 30, 2026 - Title: Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get - CVE ID: CVE-2023-33999 - CVSS: 6.1 - Researchers: Rafie Muhammad - Date: July 18, 2023 Summary The Independent Analytics plugin versions up to and including 2.15.0 are vulnerable to Stored Cross-Site Scripting. Users are advised to update to version 2.15.1 or higher to mitigate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Independent Analytics Unauth Stored XSS Vulnerability (CVE-2026-17506)