CVE-2026-15180

The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCMErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

EUVD-2026-101846

The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCMErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-15180 Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'

The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCMErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-15180

The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 2.6.0 . The root cause is insufficient input sanitization and output escaping of the 'TCM_ErrorMessages' POST parameter. This allows unauthenticated attackers t...

CVE-2026-15180: Improper Neutralization of Input During Web Page Generation

The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCMErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

WordPress Tracking Code Manager plugin <= 2.6.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Suredsi Ulpada cyberdesu in WordPress Plugin Tracking Code Manager versions = 2.6.0...

CVE-2026-28172

Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...

CVE-2026-28172

The CVE-2026-28172 entry concerns the WordPress Tracking Code Manager plugin versions up to 2.6.0, with an unauthenticated CSRF vulnerability. CVE records also describe this as CSRF that can lead to stored XSS (as noted in CVE-List entry). Affected component: Tracking Code Manager plugin; vulnera...

CVE-2026-28172 WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...

CVE-2026-28172 WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...

EUVD-2026-53948

Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...

PT-2026-68512

Name of the Vulnerable Software and Affected Versions Tracking Code Manager versions prior to 2.6.1 Description An unauthenticated Cross Site Request Forgery CSRF issue exists, which allows an attacker to induce a user to perform actions they did not intend to do by tricking them into clicking a...

CVE-2026-28172: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...

WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by timomangcut in WordPress Plugin Tracking Code Manager versions = 2.6.0...

EUVD-2024-27528

Malicious code in bioql PyPI...

EUVD-2024-29243

Malicious code in bioql PyPI...

CVE-2024-2579

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Data443 Tracking Code Manager.This issue affects Tracking Code Manager: from n/a through 2.0.16...

CVE-2024-31347

Missing Authorization vulnerability in Data443 Tracking Code Manager.This issue affects Tracking Code Manager: from n/a through 2.1.0...

CVE-2024-10309

The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...

CVE-2024-8721

The Tracking Code Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the tracking code field in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-leve...