Technical impact
A stored cross‑site scripting flaw was found in the WordPress Track, Analyze & Optimize by WP Tao plugin. The flaw arises because the plugin does not properly neutralize user‑supplied input when generating web pages, allowing attackers to inject malicious scripts that are later rendered in the browsers of visitors to the site. An attacker could craft input that is stored and displayed by the plugin, leading to execution of arbitrary code in the context of a legitimate user, potentially enabling session hijacking, defacement, or theft of sensitive data.
Affected Systems
WordPress installations that use the Track, Analyze & Optimize by WP Tao plugin version 1.3.1 or earlier. The vulnerability affects all releases from the earliest version through 1.3.1. Sites that have upgraded to 1.3.2 or later are not affected.
Risk and Exploitability
The CVSS score for this issue is 7.1, indicating a high severity. The EPSS score is not provided, and the vulnerability is not listed in CISA's KEV catalog, so no evidence of known exploitation exists. The attack vector is inferred to be via stored input: an authenticated user or the plugin’s configuration interface must accept malicious content, which is then rendered on unsuspecting visitors. Even under those constraints, the potential impact on confidentiality, integrity, and availability of the site’s users is significant due to arbitrary script execution.
