CVE-2020-20626: 
WordPress vulnerability analysis and mitigation

The WordPress Lara Google Analytics plugin version 2.0.4 and earlier was affected by an authenticated stored Cross-Site Scripting (XSS) vulnerability (CVE-2020-20626). The vulnerability was discovered and reported on October 13, 2019, affecting over 20,000 active installations. The issue was patched in version 2.0.5, which was released the same day (NinTechNet Blog).

The vulnerability existed in the main 'lara-google-analytics.php' script, specifically in the lrgawidget_callback function that was called via the WordPress AJAX API through the lrgawidget_setProfileID action. The function failed to properly sanitize the property_id field input, allowing for JavaScript code injection. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allowed authenticated users, including those with low-privilege accounts such as subscribers, to inject malicious JavaScript code into all pages and posts of the affected WordPress installation. This injected code would then be executed in the context of other users' browsers when viewing the affected pages (NinTechNet Blog).

The vulnerability was actively exploited in the wild at the time of discovery. The exploitation required an authenticated user account on the target WordPress site, even with minimal privileges such as a subscriber role (NinTechNet Blog).

Users were advised to immediately update to version 2.0.5 or later of the plugin. While the initial patch blocked the ongoing attacks, it was noted that the update still lacked proper capability checks. Users of NinjaFirewall WP Edition (free) and NinjaFirewall WP+ Edition (premium) were protected against this vulnerability (NinTechNet Blog).