CVE-2026-15180: Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'

Q: Who can exploit this issue?

An unauthenticated attacker can attempt to exploit it remotely. Successful exploitation requires convincing a user to perform an action such as clicking a link.

Q: What is the impact if exploitation succeeds?

Injected web scripts can execute in the affected page’s context. The reported impact includes limited confidentiality and integrity effects, while availability is not affected.

Q: Which installations are affected?

Data404 Tracking Code Manager for WordPress is affected in all versions through 2.6.0, inclusive.

Published Oct 15, 2026

Updated

The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCMErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affected Software

1 affected component

Data404 Tracking Code Manager<=2.6.0

Event History

Oct 15, 2026

CVE Published

via MITRE·05:30 AM

Data Sourced

via MITRE·05:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker can attempt to exploit it remotely. Successful exploitation requires convincing a user to perform an action such as clicking a link.

What is the impact if exploitation succeeds?

Injected web scripts can execute in the affected page’s context. The reported impact includes limited confidentiality and integrity effects, while availability is not affected.

Which installations are affected?