CVE-2026-15180
Deferred Deferred - Pending Action

Reflected Cross-Site Scripting in Tracking Code Manager WordPress Plugin

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Wordfence

Description
The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-15180
EUVD
EUVD-2026-101846

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
data443 Tracking Code Manager 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Tracking Code Manager plugin for WordPress has a reflected cross-site scripting (XSS) vulnerability due to insufficient input sanitization and output escaping in the 'TCM_ErrorMessages' POST parameter. This allows unauthenticated attackers to inject malicious scripts into web pages. Victims must be tricked into clicking a link to execute the injected scripts.

Detection Guidance

Detecting this vulnerability requires checking if the Tracking Code Manager plugin version 2.6.0 or below is installed on your WordPress site. Inspect plugin files for reflected XSS via the TCM_ErrorMessages POST parameter. No direct network commands detect this; manual code review or plugin version check is needed.

Impact Analysis

An attacker could steal cookies, session tokens, or other sensitive data from users who click a malicious link. They might also perform actions on behalf of users, deface websites, or redirect users to phishing pages. Users with administrative privileges are at higher risk.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face fines or penalties if user data is compromised due to this flaw.

Mitigation Strategies

Immediately update the Tracking Code Manager plugin to the latest version beyond 2.6.0. If an update is unavailable, consider disabling or removing the plugin until a patch is released. Monitor for suspicious activity or unauthorized script injections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15180. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart