Smub Exactmetrics Google Analytics Dashboard For Wordpress vulnerabilities

CVE-2026-1992 [HIGH] CWE-639 CVE-2026-1992: The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Insecure Direct The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Insecure Direct Object Reference in versions 8.6.0 through 9.0.2. This is due to the `store_settings()` method in the `ExactMetrics_Onboarding` class accepting a user-supplied `triggered_by` parameter that is used instead of the current user's ID to check permissions. Thi

CVE-2026-1993 [HIGH] CWE-269 CVE-2026-1993: The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privile The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the `update_settings()` function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible for authenticated attackers with the `exactmetrics_save

CVE-2026-5464 [HIGH] CWE-862 CVE-2026-5464: The ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) plugin for WordPr The ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation in all versions up to, and including, 9.1.2. This is due to the reports page exposing the 'onboarding_key' transient to any user with the 'exactmetrics_view_dashboard' capabili

CVE-2026-5488 [MEDIUM] CWE-862 CVE-2026-5488: The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Mi The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 9.1.2. This is due to missing capability checks in the get_ads_access_token() and reset_experience() AJAX handlers. While the mi-admin-nonce is localized on all admin pages (including profile.php which