124 matches found
Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection
The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections id: CVE-2021-24791 info: name: Header Footer Code Manag...
CVE-2026-15180
The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCMErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...
CVE-2026-15180
The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 2.6.0 . The root cause is insufficient input sanitization and output escaping of the 'TCM_ErrorMessages' POST parameter. This allows unauthenticated attackers t...
CVE-2026-15180 Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'
The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCMErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...
EUVD-2026-101846
The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCMErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...
CVE-2026-15180 Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'
The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCMErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...
PT-2026-114770
The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-15180: Improper Neutralization of Input During Web Page Generation
The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCMErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...
WordPress Tracking Code Manager plugin <= 2.6.0 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Suredsi Ulpada cyberdesu in WordPress Plugin Tracking Code Manager versions = 2.6.0...
CVE-2026-28172
Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...
EUVD-2026-53948
Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...
CVE-2026-28172 WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...
CVE-2026-28172 WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...
CVE-2026-28172
The CVE-2026-28172 entry concerns the WordPress Tracking Code Manager plugin versions up to 2.6.0, with an unauthenticated CSRF vulnerability. CVE records also describe this as CSRF that can lead to stored XSS (as noted in CVE-List entry). Affected component: Tracking Code Manager plugin; vulnera...
PT-2026-68512
Name of the Vulnerable Software and Affected Versions Tracking Code Manager versions prior to 2.6.1 Description An unauthenticated Cross Site Request Forgery CSRF issue exists, which allows an attacker to induce a user to perform actions they did not intend to do by tricking them into clicking a...
CVE-2026-28172: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...
WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by timomangcut in WordPress Plugin Tracking Code Manager versions = 2.6.0...
CVE-2026-8832: Improper Control of Generation of Code
The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.3.5 This is due to the 'wpcode' custom post type being registered without a custom capabilitytype or capability...
WordPress Code Manager plugin <= 1.0.40 - Unauthenticated Reflected Cross-Site Scripting vulnerability
Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Code Manager versions = 1.0.40...