Stape Conversion Tracking plugin lets visitors make the server send requests and inject scripts
Attackers could slip malicious scripts into WordPress sites using this tracking plugin.
Summary
The Stape Conversion Tracking WordPress plugin does not validate the proxy sub-path, so unauthenticated visitors can redirect server requests to arbitrary hosts and run malicious scripts from the site's own origin. Versions 2.3.0 through 2.3.10 are affected.
Affected when
- Stape Conversion Tracking 2.3.0 through 2.3.10 installed
What to do
Update the plugin to 2.3.11 or later.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen