CVE-2022-3904: Monsterinsights

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.

Affected products

• Monsterinsights Monsterinsights: before 8.9.1 (fixed in 8.9.1)

Published 2023-01-16. Last modified 2026-06-17.