stape-io CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH stape-io CVE published 2026-10-23

CVE-2026-55826

The GTM Server Side plugin by stape.io has a vulnerability in versions 2.0.0 to before 2.1.48 that allows an unauthenticated attacker to trigger the rendering of another customer's full order data, including personally identifiable information (PII), into the page's JavaScript dataLayer. This issue can lead to potential exposure of sensitive customer information and requires immediate attention from defen [truncated]