CVE-2026-28172: WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability

Published Aug 6, 2026

Updated

Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.

Affected Software

1 affected component

WordPress Tracking Code Manager plugin<=2.6.0

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Tracking Code Manager plugin to a version that resolves this vulnerability.
Fixed in 2.7.0

Aug 6, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

RemedyDescriptionSeverityWeakness

The severity of CVE-2026-28172 is rated as high with a score of 7.1.

To fix CVE-2026-28172, update the WordPress Tracking Code Manager plugin to version 2.6.1 or later.

CVE-2026-28172 is classified as an Unauthenticated Cross Site Request Forgery (CSRF) leading to Stored XSS vulnerability.

CVE-2026-28172 affects all versions of the WordPress Tracking Code Manager plugin up to and including version 2.6.0.

The potential impacts of CVE-2026-28172 include unauthorized actions that may lead to stored cross-site scripting (XSS) attacks.