CVE-2022-3904: MonsterInsights < 8.9.1 - Stored Cross-Site Scripting via Google Analytics

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-16 · updated 2026-06-17
Weakness: CWE-79

Description

The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.

Affected products

MonsterInsights: before 8.9.1 — fixed in 8.9.1

How to fix

Upgrade to a fixed version: MonsterInsights 8.9.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/244d9ef1-335c-4f65-94ad-27c0c633f6ad
https://wpscan.com/vulnerability/244d9ef1-335c-4f65-94ad-27c0c633f6ad

Get alerted when CVE-2022-3904 or the next vulnerability affects your stack