{"id":"CVE-2026-124995","kind":"vulnerability","aliases":["CVE-2026-124995"],"related":[],"title":"WordPress plugin Track, Analyze & Optimize: stored XSS through version 1.3.1","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-tao allows Stored XSS.This issue affects Track, Analyze & Optimize by WP Tao: from n/a through 1.3.1.","summary":"The Track, Analyze & Optimize by WP Tao plugin (slug wp-tao) up to 1.3.1 stores unescaped tracked pageview values. Per WPSec, an unauthenticated visitor can submit a script through the public wptao_event AJAX action, and it runs when an administrator opens the Most Visited Pages report.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Track, Analyze & Optimize by WP Tao","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"wp-tao","fixed":["1.3.2"],"affected":">= 1.1, <= 1.3.1","ecosystem":"wordpress"}],"ecosystems":["vendor"],"tags":["other","stored-xss","wordpress","wordpress-plugin","wp-tao","xss"],"not_affected_if":["plugin-not-installed","version-1.3.2-or-later"],"how_to_check":"In WordPress admin > Plugins, look for 'Track, Analyze & Optimize by WP Tao' (folder wp-content/plugins/wp-tao). Affected if the version is 1.3.1 or lower (WPSec lists 1.1 through 1.3.1). Or run: wp plugin get wp-tao --field=version","fix":"Update the plugin to 1.3.2 or later (released 2026-11-09 per the WordPress.org changelog, which describes it as a security release: validation of tracked data and escaping in analytics reports). The changelog does not cite this CVE; the link comes from WPSec.","status":"open","published_at":"2026-11-15T14:17:24+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","triaged_at":"2026-11-15T14:37:32+00:00","updated_at":"2026-11-15T14:39:11+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-15T14:37:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress plugin Track, Analyze & Optimize: stored XSS through version 1.3.1","impact":"medium","summary":"The Track, Analyze & Optimize WordPress plugin by WP Tao, through version 1.3.1, does not neutralize input before rendering it in pages. An attacker can store script that runs in visitors' or administrators' browsers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wp-tao"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Stored script runs in visitors' and admins' browsers","analyst_note":"Confirm the plugin slug, the fixed version (sources give only 'through 1.3.1') and whether authentication is required, via https://nvd.nist.gov/vuln/detail/CVE-2026-124995 and the WordPress plugin directory.","how_to_check":"- Check whether the `Track, Analyze & Optimize by WP Tao` plugin (slug unknown) is installed and its version is `1.3.1` or lower, in the WordPress admin under Plugins.","plain_action":"","product_name":"Track, Analyze & Optimize by WP Tao","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Track, Analyze & Optimize by WP Tao WordPress plugin at version 1.3.1 or earlier. The sources do not say which input or page triggers the stored script, or whether an account is needed to submit it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000757,"input_tokens":4569,"output_tokens":600,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the plugin slug, the fixed version (sources give only 'through 1.3.1') and whether authentication is required, via https://nvd.nist.gov/vuln/detail/CVE-2026-124995 and the WordPress plugin directory.","search":"'-124995':13A,16A '-2026':12A,15A '1.3.1':10A,52B,125C 'action':73B 'administr':79B 'affect':115C 'ajax':72B 'allow':111C 'analyz':4A,40B,103C,117C 'analyze':18A 'by':20A 'cross':95C 'cross-sit':94C 'cve':11A,14A 'event':71B 'generat':93C 'improp':86C 'input':89C 'issu':114C 'jaworski':101C 'michal':100C 'n/a':123C 'neutral':87C 'open':80B 'optim':5A,41B,104C,118C 'optimize':19A 'page':84B,92C 'pageview':56B 'per':58B 'plugin':2A,33B,45B 'public':69B 'report':85B 'run':76B 'script':66B,97C 'site':96C 'slug':46B 'store':6A,28B,53B,112C 'stored-xss':27B 'submit':64B 'tao':22A,25A,36B,44B,49B,107C,110C,121C 'track':3A,17A,39B,55B,102C,116C 'unauthent':61B 'unescap':54B 'valu':57B 'version':9A 'visit':83B 'visitor':62B 'vulner':98C 'web':91C 'wordpress':1A,30B,32B 'wordpress-plugin':31B 'wp':21A,24A,35B,43B,48B,106C,109C,120C 'wp-tao':23A,34B,47B,108C 'wpsec':59B 'wptao':70B 'xss':7A,29B,37B 'xss.this':113C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the WP Tao plugin (wp-tao) at 1.1 through 1.3.1. Per WPSec, no login is needed to plant the script, and it runs in the browser of an admin who opens the Most Visited Pages report. Sites without the plugin, or on 1.3.2 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["analyzeoptimizebywptao","trackanalyzeoptimizebywptao","wptao"],"ptokens":["analyze","by","optimize","tao","track","wp"],"labels":["high","other","storedxss","vendor","wordpress","wordpressplugin","wptao","xss"],"campaign_type":null,"search_a":"'-124995':13A,16A '-2026':12A,15A '1.3.1':10A 'analyz':4A 'analyze':18A 'by':20A 'cve':11A,14A 'optim':5A 'optimize':19A 'plugin':2A 'store':6A 'tao':22A,25A 'track':3A,17A 'version':9A 'wordpress':1A 'wp':21A,24A 'wp-tao':23A 'xss':7A","search_b":"'1.3.1':52B 'action':73B 'administr':79B 'ajax':72B 'analyz':40B 'event':71B 'open':80B 'optim':41B 'page':84B 'pageview':56B 'per':58B 'plugin':33B,45B 'public':69B 'report':85B 'run':76B 'script':66B 'slug':46B 'store':28B,53B 'stored-xss':27B 'submit':64B 'tao':36B,44B,49B 'track':39B,55B 'unauthent':61B 'unescap':54B 'valu':57B 'visit':83B 'visitor':62B 'wordpress':30B,32B 'wordpress-plugin':31B 'wp':35B,43B,48B 'wp-tao':34B,47B 'wpsec':59B 'wptao':70B 'xss':29B,37B","search_c":"'1.3.1':125C 'affect':115C 'allow':111C 'analyz':103C,117C 'cross':95C 'cross-sit':94C 'generat':93C 'improp':86C 'input':89C 'issu':114C 'jaworski':101C 'michal':100C 'n/a':123C 'neutral':87C 'optim':104C,118C 'page':92C 'script':97C 'site':96C 'store':112C 'tao':107C,110C,121C 'track':102C,116C 'vulner':98C 'web':91C 'wp':106C,109C,120C 'wp-tao':108C 'xss.this':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124995","severity":null,"published_at":"2026-11-15T14:17:24+00:00","modified_at":"2026-11-15T14:17:24+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","fetched_at":"2026-11-15T14:36:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124995:4046","url":"https://wordpress.org/plugins/wp-tao/","severity":null,"published_at":"2026-11-15T14:39:11+00:00","modified_at":"2026-11-15T14:39:11+00:00","first_seen_at":"2026-11-15T14:39:11+00:00","fetched_at":"2026-11-15T14:39:11+00:00","note":"Slug wp-tao. WPSec (third party) says unauthenticated stored XSS via public wptao_event AJAX 'event_value', fires when an admin views Most Visited Pages report; fixed 1.3.2. Maintainer changelog confirms 1.3.2 (2026-11-09) 'Security: improved validation of tracked data and escaping in analytics reports' but does not name the CVE, so nothing marked verified. Not confirmed that WPSec's issue is the same CVE (no CVE cited by WPSec). Exploitation/PoC: none seen.","cites":["https://wordpress.org/plugins/wp-tao/","https://wpsec.com/vuln/WPSEC-2026-2820/"]}],"documents":[{"id":163838,"url":"https://wordpress.org/plugins/wp-tao/","title":"WP Tao plugin page and changelog (1.3.2 security release)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":163839,"url":"https://wpsec.com/vuln/WPSEC-2026-2820/","title":"WPSEC-2026-2820: WP Tao <= 1.3.1 unauthenticated stored XSS","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}