CVE-2026-118422

High

Description

The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.

SeverityHigh

CVSS7.1

Exploit probability—

Product

Conversion Tracking WordPress plugin

PublishedNov 4, 2026

First seenNov 4, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)CWE-79Cross-site scripting (XSS)

How to fix

Update

Stape Conversion Tracking WordPress plugin2.3.11 or later

Affected products

Product	Affected versions	Fixed in
Stape Conversion Tracking WordPress plugin	No range specified	2.3.11

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.