PT-2022-18634 · Plausiblehq · Plausible Analytics

José Aguilera + 1 · Published 2022-04-11 · Updated 2022-04-18 · CVE-2022-27845

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PlausibleHQ Plausible Analytics (WordPress plugin) version 1.2.2 and earlier

Description The issue is related to an Authenticated Stored Cross-Site Scripting (XSS) in the PlausibleHQ Plausible Analytics WordPress plugin. This type of attack occurs when an attacker injects malicious code into a website, and this code is stored on the server. When other users access the website, the malicious code is executed, potentially allowing the attacker to steal user data or take control of user sessions. The attack requires the perpetrator to have an admin or higher user role.

Recommendations For PlausibleHQ Plausible Analytics (WordPress plugin) version 1.2.2 and earlier, update to a version later than 1.2.2 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-27845

Affected Products

Plausible Analytics

References · 5

• https://osv.dev/vulnerability/CVE-2022-27845 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27845 · Security Note
• https://wordpress.org/plugins/plausible-analytics/#developers · Note
• https://patchstack.com/database/vulnerability/plausible-analytics/wordpress-plausible-analytics-plugin-1-2-2-authenticated-stored-cross-site-scripting-xss-vulnerability · Note
• https://t.me/cibsecurity/40563 · Telegram Post