Google Analytics by Yoast Stored XSS #2

A second stored XSS in the admin panel of Yoast's Google Analytics WordPress plugin was patched on April 20, 2015 (version 5.4). This demo shows what it means practically. An unauthenticated attacker can fully control the website on operating system level, so updating is important. The exploit is simple: load a page with some HTML tags in the URL. If loaded enough of times, the URL will be included in the "Popular pages" section (rendered in the background when the Analytics panel is selected). A script injected in the admin panel can then e.g. write some server-side PHP and execute it, add new admin users, etc. On high-traffic sites the attacker would usually have to generate page loads programmatically. Fake page loads can be also generated. In this case the attacker doesn't have to communicate with the target site at all, but directly with Google Analytics. This vulnerability was found by Klikki Oy when investigating websites in the scope of Facebook's bug bounty program. However, no bounty was paid for the two Yoast vulnerabilities.