CVE-2026-118422 Details
Description
The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.
A vulnerability in the Stape Conversion Tracking WordPress plugin, affecting versions prior to 2.3.11, allows unauthenticated users to exploit server-side request forgery (SSRF) by manipulating the sub-path of a same-origin proxy's upstream endpoint. The plugin fails to validate this sub-path, enabling redirection of server-side requests to arbitrary hosts. The response, stripped of security headers, is returned to the site’s origin, creating a potential for SSRF attacks, including loopback and internal host access, as well as cross-site scripting (XSS) vulnerabilities.
Users are advised to update the Stape Conversion Tracking WordPress plugin to version 2.3.11 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/e41ab896-23b8-40b3-8e3f-506d6cc5b85c/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Stape Conversion Tracking | >= 2.3.0, <= 2.3.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2026 | New CVE Received | [email protected] |