CVE-2026-15180 data443 CVE debrief

Who should care

Defenders responsible for WordPress installations with the Tracking Code Manager plugin should assess exposure and apply patches or updates as necessary to prevent potential user interaction-based attacks. This includes reviewing the affected versions, applying patches or updates, and monitoring for suspicious activity related to the TCM_ErrorMessages parameter.

Why it matters

CVE-2026-15180 is a Reflected Cross-Site Scripting vulnerability in the Tracking Code Manager plugin for WordPress. Defenders should assess exposure and apply patches or updates as necessary to prevent potential user interaction-based attacks.

• Defenders must assess exposure of Tracking Code Manager plugin versions up to 2.6.0
• Successful exploitation requires user interaction to click on a crafted link
• Remediation priority is medium, with a focus on patching vulnerable plugin versions

Technical summary

The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability has a CVSS score of 6.1 and a severity of MEDIUM. Defenders should assess exposure and apply patches or updates as necessary to prevent potential user interaction-based attacks.

Defensive priority

Medium priority for defenders to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of Tracking Code Manager plugin versions up to 2.6.0
• Apply patches or updates to vulnerable plugin versions
• Monitor for suspicious activity related to TCM_ErrorMessages parameter
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information from vendor sources may be necessary for comprehensive risk assessment. The vulnerability has been publicly disclosed and defenders should verify the affected versions and apply patches or updates accordingly. The CVE Program record and NVD vulnerability detail provide further information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.