Executive Summary
CVE-2026-111820 is a stored cross-site scripting (XSS) vulnerability in the Analytics Insights – Google Analytics Dashboard for WordPress plugin. It affects all versions up to and including 6.3.12 and is rated CVSS 7.2 (High).
Per the NVD description, the cause is insufficient input sanitization and output escaping of the page title, which allows unauthenticated attackers to inject script that runs when the affected page is viewed.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-111820 |
| CVSS Score | 7.2 (High) |
| Type | Stored Cross-Site Scripting |
| Vector | Page title input |
| Authentication | None required |
| Affected Versions | All versions ≤ 6.3.12 |
Impact
Injected script executes in the browser of whoever loads the affected content, typically including site administrators who open the plugin's analytics dashboard. Possible outcomes include:
- Session or cookie theft, and actions performed as the administrator
- Creation of rogue admin accounts or plugin and theme changes through the admin session
- Redirects or malicious content shown to visitors
Remediation
- Update the plugin to a version newer than 6.3.12 once a fixed release is available; check the WordPress plugin repository for the current release.
- If no fix is available, deactivate the plugin until one is published.
- Review recorded page titles and analytics entries for unexpected HTML or script content.
- Deploy a WAF rule to block script payloads in request parameters used for page titles.
- Apply a restrictive Content Security Policy to reduce the impact of injected script.
Detection
- Unexpected
scripttags or event-handler attributes in stored page-title data - Unusual admin actions shortly after an administrator viewed the analytics dashboard
- New administrator accounts or changed plugin settings with no matching change request