WordPress Plugin Vulnerabilities

Tracking Code Manager < 2.1.0 -Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affects Plugins

Plugin icon
tracking-code-manager
Fixed in 2.1.0

References

CVE
CVE-2024-2579
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c962ba-43ef-4713-acd9-1e499f857df8

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.4 (medium)

Miscellaneous

Original Researcher
Joshua Chan
Verified
No
WPVDB ID
3c8dc17a-b545-4e83-ab35-852d8aacbe88

Timeline

Publicly Published
2024-03-18 (about 2 years ago)
Added
2024-03-22 (about 2 years ago)
Last Updated
2024-03-22 (about 2 years ago)

Other

Published
Title
Published
2023-11-07
Title
Star CloudPRNT for WooCommerce <= 2.0.3 - Reflected XSS
Published
2014-08-01
Title
The Events Calendar <= 3.0 - Reflected Cross-Site Scripting (XSS)
Published
2024-05-23
Title
Floating Chat Widget < 3.2.3 - Admin+ Stored XSS
Published
2023-07-20
Title
Post Connector < 1.0.10 - Admin+ Stored Cross-Site Scripting
Published
2019-02-16
Title
Launcher: Coming Soon & Maintenance Mode <= 1.0.10 - Multiple Stored XSS