EUVD-2026-53948
GHSA-m77r-w43m-5w96
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-delivered CSRF with no attacker privileges; UI:R for required admin interaction; S:C because stored XSS executes across all visitor browsers beyond the plugin scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.
AnalysisAI
Cross-Site Request Forgery in the Tracking Code Manager WordPress plugin (versions up to and including 2.6.0) enables remote unauthenticated attackers to inject persistent malicious scripts via a CSRF-to-Stored-XSS attack chain. The Patchstack advisory explicitly frames this as 'CSRF to Stored XSS,' meaning a forged request submitted through a logged-in administrator's session can permanently inject arbitrary JavaScript into the plugin's tracking code settings, subsequently executing in the browsers of all site visitors. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only tricking an admin into visiting a crafted page - a low barrier for a capable attacker.
Technical ContextAI
Tracking Code Manager is a WordPress plugin by Data443 Risk Mitigation, Inc. (CPE: cpe:2.3:a:data443_risk_mitigation,_inc.:tracking_code_manager:*:*:*:*:*:*:*:*) that allows site owners to inject third-party tracking pixels and scripts (e.g., Google Analytics, Facebook Pixel) sitewide. The root cause is CWE-352 (Cross-Site Request Forgery): the plugin's settings endpoints lack adequate anti-CSRF token validation, so a forged POST request from any origin is accepted if submitted by an authenticated browser session. Because the plugin persists user-supplied tracking code to the database and renders it across all pages, successful CSRF escalates to Stored XSS, causing scope change (S:C) - the injected payload executes in the browsers of all subsequent visitors, not just the targeted admin.
RemediationAI
Upgrade Tracking Code Manager to a version beyond 2.6.0 via the WordPress plugin dashboard; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/tracking-code-manager/vulnerability/wordpress-tracking-code-manager-plugin-2-6-0-csrf-to-stored-xss-vulnerability) should be consulted to confirm the exact patched release number, as an independently verified fix version is not available from the input data. If immediate upgrade is not possible, reduce risk by restricting access to the WordPress admin dashboard to trusted IP ranges via server-level controls (e.g., nginx/Apache location blocks or firewall rules), which limits the pool of potential CSRF victims. Additionally, ensure all users with plugin management privileges are trained not to click unsolicited links while authenticated to the admin panel. Implementing a Web Application Firewall (WAF) with CSRF-detection rules (e.g., Patchstack, Wordfence) provides a compensating control but should not substitute for patching, as WAF bypasses for stored XSS payloads are common.
More in Tracking Code Manager
View allThe Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could a
The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when o
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today