title: MonsterInsights < 8.9.1 - Stored Cross-Site Scripting via Google Analytics
description: The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.
problem types: CWE-79 Cross-Site Scripting (XSS)
affected:
{
vendor: Unknown
product: MonsterInsights
versions:
status: affected, versionType: custom, version: 0, lessThan: 8.9.1
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}