CVE-2026-3572

Name of the Vulnerable Software and Affected Versions iTracker360 plugin for WordPress versions prior to 2.2.1

Description The iTracker360 plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) which can lead to Stored Cross-Site Scripting (XSS). This is a result of lacking nonce verification on the settings form submission and inadequate input sanitization alongside missing output escaping. An unauthenticated attacker could inject malicious web scripts by forging a request, provided they can deceive an administrator into performing an action, such as clicking a link.

Recommendations Update the iTracker360 plugin to version 2.2.1 or later.