Threat database

The Tracking Code Manager plugin for WordPress has a reflected cross-site scripting (XSS) vulnerability via the 'TCM_ErrorMessages' POST parameter in all versions up to and including 2.6.0. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when a user is tricked into interacting with a crafted link. The issue arises from insufficient input sanitization and output escaping.

Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.

CVE-2026-28172 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting Data443 Risk Mitigation, Inc.'s Tracking Code Manager versions up to and including 2.6.0. The vulnerability allows unauthenticated attackers to perform actions on behalf of a user by exploiting CSRF weaknesses. No official patch or remediation guidance is currently available from the vendor. The vulnerability has a CVSS 3.1 score of 7.1, indicating a significant risk due to its network attack vector and impact on confidentiality, integrity, and availability.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Posts Footer Manager intelly-posts-footer-manager allows Stored XSS.This issue affects Posts Footer Manager: from n/a through <= 2.2.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Welcome Bar intelly-welcome-bar allows Stored XSS.This issue affects Welcome Bar: from n/a through <= 2.0.4.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Posts Footer Manager intelly-posts-footer-manager allows Stored XSS.This issue affects Posts Footer Manager: from n/a through <= 2.1.0.

The Tracking Code Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the tracking code field in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-10309 is a duplicate of this issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. LGPD Framework lgpd-framework allows Reflected XSS.This issue affects LGPD Framework: from n/a through <= 2.0.2.

Missing Authorization vulnerability in Data443 Tracking Code Manager.This issue affects Tracking Code Manager: from n/a through 2.1.0.

Cross-Site Request Forgery (CSRF) vulnerability in Data443 Inline Related Posts.This issue affects Inline Related Posts: from n/a through 3.3.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Tracking Code Manager.This issue affects Tracking Code Manager: from n/a through 2.0.16.