CVE-2022-1435: Wptaskforce Track & Trace

Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days.

The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

Affected products

• Wptaskforce Track & Trace: before 6.9.5 (fixed in 6.9.5)

Published 2022-05-16. Last modified 2026-06-17.