Tracking Code Manager EUVD-2026-101846

Exploitation requires that a victim with access to the affected site be tricked into clicking an attacker-crafted link or submitting a request carrying a script payload in the 'TCM_ErrorMessages' POST parameter, which the plugin reflects into a page without sanitization or output escaping. No authentication is required of the attacker (PR:N), and default configurations of Tracking Code Manager ≤2.6.0 are affected - the plugin feature itself is the vulnerable sink. The key limiting factors are: mandatory user interaction (UI:R), and the reflected (non-persistent) nature of the flaw, meaning each victim must be individually lured rather than compromised by merely visiting a stored page.

This is a moderate-severity reflected XSS (CVSS 6.1, CWE-79) with a coherent set of signals pointing to real-but-limited risk. The CVSS vector AV:N/AC:L/PR:N/UI:R confirms a network-reachable, low-complexity, unauthenticated attack that nevertheless REQUIRES victim interaction (clicking a crafted link), which is the single largest mitigating factor and typical of reflected (non-stored) XSS. Scope is changed (S:C) because injected script executes in the victim's browser context outside the vulnerable component, with limited confidentiality and integrity impact (C:L/I:L) and no availability impact (A:N). No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or mass automation - the finding originates from Wordfence research rather than observed attacks. Net assessment: a legitimate issue to patch on exposed WordPress sites, but not an emergency priority in the absence of exploitation signals; reflected XSS requiring per-victim social engineering is rarely weaponized at scale compared to stored XSS or unauthenticated RCE.

An unauthenticated attacker crafts a malicious link (or auto-submitting form) that sends a POST request with a script payload in the 'TCM_ErrorMessages' parameter to a site running Tracking Code Manager ≤2.6.0. When a victim is socially engineered into clicking the link, the unsanitized value is reflected into the page and the script executes in the victim's browser, potentially stealing session cookies or performing actions as that user. No public exploit code was identified in the provided data, though the vulnerability mechanics are straightforward to reproduce.