deconf vulnerabilities

Products

• analytics insights 1
• Analytics Insights – Google Analytics Dashboard for WordPress 1
• clicky analytics dashboard 1

Latest deconf CVEs

Newest publication first

1. CVE-2026-111820 Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title

   Published 2026-10-27

   High·CVSS 7.2 EPSS 0.24%

   The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes it possible f...

2. CVE-2024-0250 Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect

   Published 2024-02-12

   Medium·CVSS 6.1 EPSS 1.3%

   The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious...

3. CVE-2023-40658 Extension - deconf.net - Reflected XSS in Clicky Analytics Dashboard module for Joomla 1.0.0-1.3.1

   Published 2023-12-14

   Medium·CVSS 6.1 EPSS 0.40%

   A reflected XSS vulnerability was discovered in the Clicky Analytics Dashboard module for Joomla.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.