CVE-2026-15180: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in data443 Tracking Code Manager

CVE-2026-15180 is a reflected cross-site scripting vulnerability in the data443 Tracking Code Manager WordPress plugin. The flaw arises from insufficient input sanitization and output escaping of the 'TCM_ErrorMessages' POST parameter. This allows unauthenticated attackers to inject malicious scripts that execute in the context of the victim's browser if the victim is tricked into clicking a malicious link or performing a crafted action. The vulnerability affects all versions up to and including 2.6.0.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure or manipulation of the user interface. The vulnerability requires user interaction (clicking a link) and does not require authentication. There is no indication of availability impact. The CVSS 3.1 base score is 6.1 (medium severity).

No official patch or fix is currently referenced in the provided data. Users should check the vendor's advisory for updates. Until a fix is available, users should exercise caution with untrusted links and consider disabling or restricting use of the Tracking Code Manager plugin. Monitor vendor channels for patch releases.