CVE-2021-24438

ShareThis Dashboard for Google Analytics < 2.5.2 - Reflected Cross-Site Scripting (XSS)

State: Published
Severity: Not scored
Published: Aug 30, 2021
Updated: Aug 3, 2024
Reserved: Jan 14, 2021

Description

The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator

Scores

The record has no CVSS score.

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
ShareThis Dashboard for Google AnalyticsUnknown	2.5.2 to before 2.5.2Affected

References

https://wpscan.com/vulnerability/af472879-9328-45c2-957f-e7bed77e4c2d

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.