---
id: "CVE-2026-118422"
kind: "vulnerability"
aliases: ["CVE-2026-118422"]
title: "Stape Conversion Tracking WordPress plugin: unauthenticated SSRF and cross-site scripting"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "stape", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-2.3.11-or-later"]
published_at: "2026-11-04T06:17:03+00:00"
first_seen_at: "2026-11-04T06:25:19+00:00"
updated_at: "2026-11-04T06:26:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118422", "first_seen_at": "2026-11-04T06:25:19+00:00"}]
---

# Stape Conversion Tracking WordPress plugin: unauthenticated SSRF and cross-site scripting

The Stape Conversion Tracking WordPress plugin before 2.3.11 fails to validate a sub-path on its same-origin proxy, so anyone can make the site's server request arbitrary hosts, including internal ones. The attacker can also get the response returned from the site's own origin with security headers removed, which enables cross-site scripting.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Stape Conversion Tracking plugin in the WordPress admin under Plugins; versions below `2.3.11` are affected.
- Confirm whether the plugin's same-origin proxy endpoint is reachable from the internet on the site.

## Fix

- Stape Conversion Tracking WordPress plugin: `2.3.11` or later (the fix is stated as the version before which the plugin is vulnerable).

## Timeline

- 2026-11-04T06:25:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118422

## From the sources

The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_