ExactMetrics is an open-source plugin for WordPress which connects Google Analytics with your website. You can find source code at https://github.com/awesomemotive/Google-Analytics-Dashboard-for-WP __.

Responsible Disclosure Guidelines

We are committed to working with security researchers to verify, reproduce, and respond to legitimate reported vulnerabilities. You can help us by following these simple guidelines:

• Provide details of the vulnerability, including information needed to reproduce and validate the vulnerability and a Proof of Concept (PoC)
• Make a good faith effort to avoid privacy violations, destruction and modification of data on live sites (please, consider installing ExactMetrics __locally)
• Give us a reasonable time to correct the issue before making any information public

Qualifying Vulnerabilities

Any reproducible vulnerability that affects the security of our users is likely to be in scope for the program. Common examples include:

• Cross Site Scripting (XSS)
• Cross Site Request Forgery (CSRF)
• Server Side Request Forgery (SSRF)
• Remote Code Execution (RCE)
• SQL Injection (SQLi)

We generally aren’t interested in the following problems:

• Security vulnerabilities in WordPress core: here is where you can report them
• Reports for hacked websites: here is what you can do __
• Open API endpoints serving public data
• Path disclosures for errors, warnings, or notices
• Plugin version number disclosure
• Mixed content warnings
• Lack of HTTP security headers
• Brute force, DDoS, phishing, text injection, or social engineering attacks
• Google Analytics platform and resources related issues
• Any vulnerability with a CVSS 3 score lower than 4.0, unless it can be combined with other vulnerabilities to achieve a higher score
• Output from automated scans - please manually verify issues and include a valid proof of concept

If you think you found an exception, please, let us know.

Rewards

At this time, we are not awarding bounties or cash rewards for reported vulnerabilities. As our vulnerability disclosure program matures, we'll start including monetary bounties for valid security reports.

Thank you for helping keep ExactMetrics and our users safe!