CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-52220 – WordPress MonsterInsights plugin <= 8.21.0 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2023-52220
Missing Authorization vulnerability in MonsterInsights Google Analytics by Monster Insights.This issue affects Google Analytics by Monster Insights: from n/a through 8.21.0. Vulnerabilidad de autorización faltante en MonsterInsights Google Analytics de Monster Insights. Este problema afecta a Google Analytics de Monster Insights: desde n/a hasta 8.21.0. The Google Analytics by Monster Insights plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in versions up to, and including, 8.21.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action. • https://patchstack.com/database/vulnerability/google-analytics-for-wordpress/wordpress-monsterinsights-plugin-8-21-0-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23887 – Easy Google Analytics for WordPress <= 1.6.0 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2023-23887
The Easy Google Analytics for WordPress plugin is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0. This is due to missing or incorrect nonce validation in the 'ga_admin_set.php' file. This makes it possible for unauthenticated attackers to update the plugin's Google Analytics account and client ID options to arbitrary values including a stored Cross-Site Scripting payload granted they can trick a site administrator into performing an action such as clicking on a link. Additionally the 'ga_admin_set.php' can be accessed directly, and though it is not possible to update options by doing so, loading it via a separate LFI vulnerability would allow an attacker to update options as well. • CWE-352: Cross-Site Request Forgery (CSRF) •