bensibley vulnerabilities

Products

• Independent Analytics – WordPress Analytics Plugin 2
• Independent Analytics 1
• Unlimited 1

Latest bensibley CVEs

Newest publication first

1. CVE-2026-17506 Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting

   Published 2026-08-05

   High·CVSS 7.2 EPSS 0.40%

   The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 not_found_url tracking parameter in versions up to, and including, 2.15.0. This is due to the get_cell_content() function applying urldecode() after esc_url() when rendering th...

2. CVE-2026-5737 Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route

   Published 2026-05-28

   Medium·CVSS 6.5 EPSS 0.37%

   The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.14.9. This is due to a public tracking route at /wp-json/iawp/search that accepts attacker-controlled referrer_url values when the signature matches...

3. CVE-2024-13362 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

   Published 2026-05-01

   Medium·CVSS 6.1 EPSS 0.28%

   Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

4. CVE-2025-31073 WordPress Unlimited plugin <= 1.45 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-03-28

   Medium·CVSS 6.5 EPSS 0.21%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bensibley Unlimited unlimited allows Stored XSS.This issue affects Unlimited: from n/a through <= 1.45.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.