Stored Cross-Site Scripting Vulnerability in WordPress Tracking Code Manager Plugin

Summary

The Tracking Code Manager plugin for WordPress has a vulnerability that allows authenticated attackers with Contributor-level access or higher to conduct Stored Cross-Site Scripting (XSS) attacks. This vulnerability arises from inadequate input sanitization and output escaping in the tracking code field. An attacker can inject arbitrary web scripts into pages, which could execute whenever a user accesses the compromised pages, potentially leading to session hijacking, data theft, or further attacks on website visitors.

References