Plugin inspection:

Google Analytics Dashboard

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.

Warnings

The version of this plugin that this recommendation was based on is known to be vulnerable to attack:

This recommendation applies to version 2.0.4 of this plugin, but the most recent version is 2.1.1. These findings may no longer be correct.

Findings

Among the issues identified are:

  • Causes PHP notices – WP deprecation warnings, among other things
  • A lack of HTML escaping
  • $wpdb is only used once, but that invocation contains an SQL injection vulnerability which can be exploited by admins or anybody able to make an admin visit a certain address

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

SQL injection.

Failure criteria

  • Execution of unprepared SQL statements
  • Failure to use available core functionality
  • Unsafe request processing
  • Lack of proper output escaping

Read more about our failure criteria.