ShareThis Dashboard for Google Analytics < 2.5.2 – Reflected Cross-Site Scripting (XSS) | CVE 2021-24438 | Plugin Vulnerabilities

Description

The plugin does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator

Proof of Concept

Plugin needs to be connected to Google Analytics account.

https://example.com/wp-admin/admin.php?page=googleanalytics&ga_action=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E

Affects Plugins

googleanalytics

Fixed in 2.5.2

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

renniepak

Submitter

renniepak

Submitter twitter

Verified

Yes

WPVDB ID

af472879-9328-45c2-957f-e7bed77e4c2d

Timeline

Publicly Published

2021-08-02 (about 4 years ago)

Added

2021-08-02 (about 4 years ago)

Last Updated

2022-02-24 (about 3 years ago)

Other

Published

Title

Published

2025-10-12

Title

YOP Poll < 6.5.38 - Unauthenticated Stored Cross-Site Scripting

Published

2025-06-05

Title

Developer Formatter <= 2015.0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom CSS

Published

2024-07-10

Title

Arkhe Blocks < 2.23.0 - Contributor+ Stored XSS

Published

2024-07-10

Title

WP Announcement < 2.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2021-12-14

Title

Simple Image Gallery <= 1.0.6 - Reflected Cross-Site Scripting