stape_conversion_tracking vulnerabilities

CVEs whose affected-version data names the stape_conversion_tracking package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-118422High· 7.1

4d ago

Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path

The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host…

▾ TwilightEPSS 0.18%via CVEORG