Skip to content
Sign in
6.1 Medium

CVE-2022-3904 The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages…

Description

The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.

Affected products and versions

Product Affected versions Fixed in
MonsterInsights 8.9 earliest → < 8.9.1 8.9.1

Other CVEs of MonsterInsights

The 3 CVEs of MonsterInsights →
CVE-2026-11366 The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its… 3.7 Low CVE-2023-0081 The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before… 5.4 Medium
Track this CVE