CVE-2021-24438CWE-79

ShareThis Dashboard for Google Analytics < 2.5.2 - Reflected Cross-Site Scripting (XSS)

published August 30, 2021

CVSS
—
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00827 · 57.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-08-30T14:11Z
EPSS history
Timeline
  • 30 AUG 14:11Z
    ShareThis Dashboard for Google Analytics < 2.5.2 - Reflected Cross-Site Scripting (XSS)
    cvelistv5