CVE-2026-118422

HighCVSS 7.1/10Last modified Nov 4, 2026

Description

The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Unknown	Stape Conversion Tracking	>= 2.3.0, < 2.3.11

References

https://wpscan.com/vulnerability/e41ab896-23b8-40b3-8e3f-506d6cc5b85c/

Timeline

Published: Nov 4, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-11842310.0The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticat CVE-2026-1184256.8A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occur CVE-2026-1184265.3In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search CVE-2026-1184355.4Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation.CVE-2026-1184373.7The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauth CVE-2026-1184386.8The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser,CVE-2026-1184394.1The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a use CVE-2026-118444.9The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Arbitrary File Read vulnerability, allowing privileged rem CVE-2026-1184444.8Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The n CVE-2026-1184456.9A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are expo CVE-2026-1184466.9A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND array CVE-2026-1184474.8A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. T