A vulnerability was found in data443 Tracking Code Manager Plugin up to 2.6.0 on WordPress and classified as problematic. Impacted is an unknown function. The manipulation of the argument TCM_ErrorMessages results in cross site scripting. This vulnerability is known as CVE-2026-15180. It is possible to launch the attack remotely. No exploit is available.
WordPress
Vulnerability
CVE-2026-15180
VulDB
Apply vendor security patch