CVE-2023-34173

35th percentile - higher than 35% of all known CVEs

The Yandex Metrica Counter plugin versions up to 1.4.3 contains a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+). An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the context of users' browsers.

Organizations using this plugin may be exposed to session data theft, user account takeover, or other XSS-related attacks. In particular, an attacker with access to the admin panel can introduce malicious code.

It is recommended to update the Yandex Metrica Counter plugin to the latest version to mitigate this vulnerability. Additionally, conducting a security audit of the application to identify other potential vulnerabilities is advisable.