CVE-2024-10309

The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.

Score

CVSS 3.1 5.9 Medium

Status

Analyzed - contact@wpscan.com

Published

2025-01-30

Last modified

2025-01-30

Weaknesses

CWE-79

Affected products

• Tracking Code Manager (Data443)
• Tracking Code Manager (Unknown)

References

• https://wpscan.com/vulnerability/9eb21250-34bd-4600-a0a5-7c5117f69f04/