CVE-2026-118422: Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path
The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Stape Conversion Tracking WordPress pluginto a version that resolves this vulnerability.Fixed in 2.3.11
Event History
Frequently Asked Questions
Which installations are affected?
WordPress sites using Stape Conversion Tracking versions 2.3.0 through 2.3.10 are affected. Version 2.3.11 is identified as the version where the issue is addressed.
Does exploitation require an account or special permissions?
No. An unauthenticated visitor can exploit the issue, although user interaction is required for the XSS impact according to the supplied vector.
What can an attacker reach through the SSRF?
The attacker can redirect the server-side request to arbitrary hosts, including loopback addresses and internal hosts. The proxied response body and content type can be returned from the affected site's origin with security response headers stripped.
Why can this lead to cross-site scripting?
Because attacker-controlled upstream content can be returned from the site's own origin with its content type preserved and security response headers stripped. This can enable script content to be served as though it originated from the affected site.