matomoteam vulnerabilities

Products

• Connect Matomo – Analytics Dashboard for WordPress 1
• Matomo Analytics 1
• Matomo Analytics – Powerful, Privacy-First Insights for WordPress 1

Latest matomoteam CVEs

Newest publication first

1. CVE-2024-38766 WordPress Matomo Analytics plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) leading to Notice Dismissal vulnerability

   Published 2025-01-02

   Medium·CVSS 4.3 EPSS 0.20%

   Cross-Site Request Forgery (CSRF) vulnerability in matomoteam Matomo Analytics matomo allows Cross Site Request Forgery.This issue affects Matomo Analytics: from n/a through <= 5.1.1.

2. CVE-2023-6923 Matomo <= 4.15.3 - Reflected Cross-Site Scripting via idsite

   Published 2024-02-20

   Medium·CVSS 6.1 EPSS 0.55%

   The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible f...

3. CVE-2023-4774 WP-Matomo Integration (WP-Piwik) <= 1.0.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

   Published 2023-09-22

   Medium·CVSS 5.4 EPSS 0.68%

   The WP-Matomo Integration (WP-Piwik) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versions up to, and including, 1.0.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.