Stored Cross-Site Scripting Vulnerability in Independent Analytics Pro Plugin for WordPress

CVE-2026-104744

What is CVE-2026-104744?

The Independent Analytics Pro plugin for WordPress is susceptible to stored cross-site scripting due to inadequate input sanitization and output escaping in the 'utm_campaign' parameter. This vulnerability allows unauthorized attackers to inject harmful scripts that execute when users access compromised pages. The exploitation process involves the attacker initially obtaining a server-signed payload by visiting a frontend page, which can then be utilized to exploit the unauthenticated /iawp/search REST endpoint, as the plugin does not apply signature checks to utm_* fields.

References