CVE-2022-1436: Wptaskforce Track & Trace

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks.

Affected products

• Wptaskforce Track & Trace: before 6.9.5 (fixed in 6.9.5)

Published 2022-05-16. Last modified 2026-06-17.