EUVD-2026-13925Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The iTracker360 plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in all versions up to and including 2.2.0. This is due to missing nonce verification on the settings form submission and insufficient input sanitization combined with missing output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
AnalysisAI
The iTracker360 WordPress plugin (versions up to 2.2.0) contains a combined Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) vulnerability in its settings form submission handler. An unauthenticated attacker can craft a malicious link or webpage that, when clicked by an administrator, injects arbitrary JavaScript code into the plugin's stored settings due to missing nonce verification and insufficient input sanitization/output escaping. This vulnerability is classified as medium severity (CVSS 6.1) and poses a real risk to WordPress sites using this plugin, as exploitation requires only user interaction and network access with no special privileges.
Technical ContextAI
The iTracker360 plugin for WordPress (cpe:2.3:a:itracker360:itracker360:*:*:*:*:*:*:*:*) fails to implement nonce-based CSRF protection on admin settings forms, a WordPress best practice enforced via wp_verify_nonce(). The vulnerability roots in two CWE-79 (Improper Neutralization of Input During Web Page Generation) weaknesses: (1) missing nonce tokens that would validate form submissions originate from authenticated admin sessions, and (2) insufficient input sanitization on settings parameters combined with missing output escaping when rendering those settings. The referenced code locations (itracker360.php lines 115-116, 187 in both trunk and version 2.1.9) indicate the vulnerable form handler and settings retrieval/display code lack WordPress security functions like sanitize_text_field(), wp_kses_post(), or esc_attr().
RemediationAI
Update iTracker360 to version 2.2.1 or later, which should include nonce verification on all settings form submissions and proper input sanitization/output escaping. Until a patched version is released and deployed, site administrators should disable or remove the iTracker360 plugin entirely. As a temporary mitigation, restrict WordPress admin access via IP whitelisting or require authentication at the reverse proxy/web application firewall level, though this does not fully protect against CSRF attacks from admin-controlled networks. Monitor plugin changelogs at https://plugins.trac.wordpress.org/browser/itracker360/ and the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5ef842ad-3d23-4206-af3b-b3f55486766f for patch availability.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today