CVE-2026-118422

UNKNOWN 0.0

Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.

Vendor	unknown
Product	stape conversion tracking
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for unknown stape conversion tracking

Be the first to know when new unknown vulnerabilities affecting unknown stape conversion tracking are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Stape Conversion Tracking

2.3.0 < 2.3.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/e41ab896-23b8-40b3-8e3f-506d6cc5b85c/

Credits

Joep van Antwerpen WPScan