{"affected":[{"defaultStatus":"unaffected","product":"Stape Conversion Tracking","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.3.11","status":"affected","version":"2.3.0","versionType":"semver"}]}],"cveId":"CVE-2026-118422","cwes":["CWE-918","CWE-79"],"description":"The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/e41ab896-23b8-40b3-8e3f-506d6cc5b85c/"}],"kev":null,"metrics":[],"modifiedAt":1793772028261,"publishedAt":1793772028261,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/e41ab896-23b8-40b3-8e3f-506d6cc5b85c/"}],"remediation":[],"revision":"42157b1160fd245e22f92fe771d46cf4d4ad3ea819a49bf4a583ff260f45ce24","sources":[{"modifiedAt":1793772028261,"name":"CNA: WPScan","retrievedAt":1793776145628,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118422"}],"ssvc":null,"status":"published","title":"Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path","updatedAt":1793776145628}