CVE-2026-17506

Name of the Vulnerable Software and Affected Versions Independent Analytics plugin for WordPress versions prior to 2.15.1

Description Stored Cross-Site Scripting occurs via the not found url tracking parameter. The issue arises because the get cell content() function applies urldecode() after esc url() when rendering the URL column for 404 entries. This sequence allows percent-encoded HTML to bypass URL validation and be reconstructed as raw markup, which wp kses post() fails to strip as it retains img elements and data-* attributes. Additionally, the public REST endpoint '/iawp/search' accepts unauthenticated requests provided they carry a signature embedded in public page HTML. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an affected page.

Recommendations Update the Independent Analytics plugin for WordPress to version 2.15.1 or later.