The Tracking Code Manager plugin for WordPress contains a reflected cross‑site scripting vulnerability that is triggered when an attacker submits a HTTP POST request with a malicious value in the TCM_ErrorMessages parameter. Because the plugin does not apply input sanitization or output escaping to this parameter, the supplied text is rendered directly in the page content. As a result, an unauthenticated attacker can cause arbitrary JavaScript to execute in the browsers of users who visit a crafted page, giving the attacker the ability to run client‑side code within the site’s domain.

The vulnerability exists in all releases of the data443 Tracking Code Manager WordPress plugin up to and including version 2.6.0. No operating‑system or PHP version constraints are stated, meaning any WordPress installation that uses one of these affected versions is potentially vulnerable.

The CVSS base score of 6.1 classifies this flaw as medium severity. Exploit probability is not quantified because EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. A likely attack requires an unauthenticated attacker to craft a POST request containing a malicious TCM_ErrorMessages value and convince a site visitor to load that page; once the page is rendered, the injected script runs in the visitor’s browser.