The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cros…
CVSS 3.1MEDIUM 5.9·Network·High privileges·User interaction·EPSS 0.00273·Published 2025-01-30·Fixed in 2.4.0CWE-79
The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the…
CVSS 3.1MEDIUM 4.8·Network·High privileges·User interaction·EPSS 0.00362·Published 2025-05-15·Fixed in 2.3.0CWE-79