What the vulnerability does
01Description
The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tiktok_user_id’ parameter in all versions up to, and including, 7.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
Conversios contains a cross-site scripting (XSS) vulnerability in versions up to 7.1.0. An attacker can inject malicious scripts that execute in a victim's browser when they interact with a compromised page. The vulnerability requires user interaction and network access but does not require authentication. The injected script can read or modify page content and affect other users on the same site.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in a victim's browser and steals data or modifies page content.
Potential impact on your site
04Site Impact
Visitors to your site may have their session data stolen or see altered content if an attacker exploits this vulnerability.
Conditions required to exploit
05Prerequisites
Victim must visit a page containing the attacker's malicious input; no authentication required.
Key dates
06Disclosure timeline
June 28, 2024
CVE published
April 8, 2026
Record updated
