Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 12:18:56 +0000 CVE-2026-55826 — Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPre… https://db.gcve.eu/vuln/cve-2026-55826 <p><strong>Affected:</strong> stape-io gtm-server-side-wordpress-plugin</p> <p>The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer&#39;s full order data — including personally identifiable information (PII) — into the page&#39;s JavaScript dataLayer. This issue has been patched in version 2.1.48.</p> <p><strong>Affected:</strong> stape-io gtm-server-side-wordpress-plugin</p> <p>The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer&#39;s full order data — including personally identifiable information (PII) — into the page&#39;s JavaScript dataLayer. This issue has been patched in version 2.1.48.</p> https://db.gcve.eu/vuln/cve-2026-55826