EUVD-2026-53948
GHSA-m77r-w43m-5w96
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-delivered CSRF with no attacker privileges; UI:R for required admin interaction; S:C because stored XSS executes across all visitor browsers beyond the plugin scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.
AnalysisAI
Cross-Site Request Forgery in the Tracking Code Manager WordPress plugin (versions up to and including 2.6.0) enables remote unauthenticated attackers to inject persistent malicious scripts via a CSRF-to-Stored-XSS attack chain. The Patchstack advisory explicitly frames this as 'CSRF to Stored XSS,' meaning a forged request submitted through a logged-in administrator's session can permanently inject arbitrary JavaScript into the plugin's tracking code settings, subsequently executing in the browsers of all site visitors. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attack requires that: (1) the target WordPress site has the Tracking Code Manager plugin installed and active in a version at or below 2.6.0; (2) a user with sufficient privileges to modify the plugin's settings (typically a WordPress administrator) must visit an attacker-controlled page or click a crafted link while authenticated to the WordPress admin session - this is the UI:R condition from the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) accurately reflects the attack model: network-reachable, low complexity, no attacker privileges required, but dependent on a single user-interaction step (an admin clicking an attacker-crafted link). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Tracking Code Manager to a version beyond 2.6.0 via the WordPress plugin dashboard; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/tracking-code-manager/vulnerability/wordpress-tracking-code-manager-plugin-2-6-0-csrf-to-stored-xss-vulnerability) should be consulted to confirm the exact patched release number, as an independently verified fix version is not available from the input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately (within 24 hours): Audit all WordPress instances for Tracking Code Manager plugin versions 2.6.0 and earlier; notify all site administrators of exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Tracking Code Manager
View allThe Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could a
The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when o
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today