CVE-2022-3132

What it actually does

The plugin fails to sanitize and escape certain settings fields, permitting high-privilege users to store persistent JavaScript payloads that execute in other users' browsers despite the unfiltered_html capability being disabled.

Why it matters to the business

Successful exploitation can lead to theft of session tokens or administrative actions performed under other users' accounts, resulting in unauthorized data access, content tampering, or loss of trust in the affected website.

How an attack unfolds

An attacker obtains high-privilege WordPress credentials, accesses the plugin configuration page, stores a crafted script in an unsanitized setting, and waits for another administrator or user to load the affected dashboard or page where the payload executes.

How to fix it

Upgrade the Goolytics plugin to version 1.1.2 or later, which applies proper sanitization and escaping to all settings.

How to confirm the fix worked

After the update, attempt to save HTML or script content in the plugin settings fields and confirm that the input is rejected or escaped; review the plugin source for esc_attr and wp_kses usage on stored values.

Typical attack path

1. Gain high-privilege WordPress administrative access
2. Locate the Goolytics settings page
3. Insert a malicious script payload into an unsanitized configuration field
4. Trigger the payload by having a victim user view the affected page
5. Perform actions such as session hijacking or unauthorized configuration changes

How to detect it

Inspect WordPress database options table or plugin settings export files for script tags or event handlers; examine web server and browser console logs for unexpected JavaScript execution originating from plugin settings pages.

What your security team should do

• Immediately update the Goolytics plugin to version 1.1.2 or newer
• Review and restrict high-privilege accounts to the minimum necessary users
• Enable a web application firewall with XSS detection rules
• Audit plugin settings change logs for suspicious entries