{"id":"CVE-2026-118422","kind":"vulnerability","aliases":["CVE-2026-118422"],"related":[],"title":"Stape Conversion Tracking WordPress plugin: unauthenticated SSRF and cross-site scripting","description":"The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.","summary":"The Stape Conversion Tracking WordPress plugin before 2.3.11 fails to validate a sub-path on its same-origin proxy, so anyone can make the site's server request arbitrary hosts, including internal ones. The attacker can also get the response returned from the site's own origin with security headers removed, which enables cross-site scripting.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","stape","wordpress"],"not_affected_if":["plugin-not-installed","version-2.3.11-or-later"],"how_to_check":"- Check the installed version of the Stape Conversion Tracking plugin in the WordPress admin under Plugins; versions below `2.3.11` are affected.\n- Confirm whether the plugin's same-origin proxy endpoint is reachable from the internet on the site.","fix":"- Stape Conversion Tracking WordPress plugin: `2.3.11` or later (the fix is stated as the version before which the plugin is vulnerable).","status":"open","published_at":"2026-11-04T06:17:03+00:00","first_seen_at":"2026-11-04T06:25:19+00:00","triaged_at":"2026-11-04T06:26:11+00:00","updated_at":"2026-11-04T06:26:11+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T06:26:11Z","model":"claude-haiku-5-5","output":{"fix":"- Stape Conversion Tracking WordPress plugin: `2.3.11` or later (the fix is stated as the version before which the plugin is vulnerable).","reach":"internet","title":"Stape Conversion Tracking WordPress plugin: unauthenticated SSRF and cross-site scripting","impact":"medium","summary":"The Stape Conversion Tracking WordPress plugin before 2.3.11 fails to validate a sub-path on its same-origin proxy, so anyone can make the site's server request arbitrary hosts, including internal ones. The attacker can also get the response returned from the site's own origin with security headers removed, which enables cross-site scripting.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","stape","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reaches internal hosts and injects script into the site origin","analyst_note":"Confirm whether the proxy is enabled by default and whether any exploitation has been reported; the sources give only the NVD description.","how_to_check":"- Check the installed version of the Stape Conversion Tracking plugin in the WordPress admin under Plugins; versions below `2.3.11` are affected.\n- Confirm whether the plugin's same-origin proxy endpoint is reachable from the internet on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-2.3.11-or-later"],"who_is_affected":"Sites running the Stape Conversion Tracking WordPress plugin before 2.3.11 are exposed, because its proxy endpoint accepts unauthenticated requests and forwards them without validating the destination. Sites without this plugin installed, or running 2.3.11 or later, are not affected. The sources do not say whether non-default configuration changes exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000756,"input_tokens":4171,"output_tokens":678,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118422':15A,18A '-2026':14A,17A '2.3.11':32B,91C 'allow':109C 'also':63B 'anyon':47B 'append':99C 'arbitrari':55B,121C 'attack':61B 'bodi':127C 'content':130C 'convers':2A,27B,86C 'cross':10A,81B,158C 'cross-sit':9A,80B,157C 'cve':13A,16A 'enabl':79B 'endpoint':108C 'fail':33B 'forgeri':150C 'get':64B 'header':76B,142C 'host':22B,56B,122C,155C 'includ':57B,151C 'intern':58B,154C 'lead':144C 'loopback':152C 'make':49B 'one':59B 'origin':44B,73B,104C,138C 'packag':19B 'path':39B,98C 'plugin':5A,30B,89C 'proxi':45B,105C 'redirect':113C 'remov':77B 'request':54B,118C,149C 'respons':66B,126C,141C 'return':67B,132C 'same-origin':42B,102C 'script':12A,83B,160C 'secur':75B,140C 'self':21B 'self-host':20B 'server':53B,116C,147C 'server-sid':115C,146C 'side':117C,148C 'site':11A,51B,70B,82B,135C,159C 'ssrf':7A 'stape':1A,23B,26B,85C 'strip':143C 'sub':38B,97C 'sub-path':37B,96C 'track':3A,28B,87C 'type':131C 'unauthent':6A,110C 'upstream':107C 'valid':35B,94C 'visitor':111C 'wordpress':4A,24B,29B,88C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Stape Conversion Tracking WordPress plugin before 2.3.11 are exposed, because its proxy endpoint accepts unauthenticated requests and forwards them without validating the destination. Sites without this plugin installed, or running 2.3.11 or later, are not affected. The sources do not say whether non-default configuration changes exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","stape","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118422","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118422","severity":null,"published_at":"2026-11-04T06:17:03+00:00","modified_at":"2026-11-04T06:17:03+00:00","first_seen_at":"2026-11-04T06:25:19+00:00","fetched_at":"2026-11-04T06:25:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}