The GTM Server Side plugin for WordPress (Stape Conversion Tracking) suffers from a reflected XSS vulnerability due to the use of add_query_arg without proper escaping on URL parameters. This flaw exists in all versions up to 2.1.19 and enables unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser if they click a malicious link. The vulnerability is tracked as CVE-2024-8712 with a CVSS 3.1 base score of 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially allowing theft of sensitive information or session hijacking. The vulnerability requires user interaction (clicking a crafted link) and does not grant direct system access or availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links involving the affected plugin and consider disabling or limiting the plugin's use. Monitor vendor channels for updates and apply patches promptly once available.