Stape Conversion Tracking

Stape Conversion Tracking has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2024; all 2 are fixed as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 6.1 out of 10.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

Every one of the 2 issues recorded for Stape Conversion Tracking has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by vgo0. Stape Conversion Tracking is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.0.

Strategic Overview

Avg CVSSMedium
5.8/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Stape Conversion Tracking vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.1CVE-2024-8712

GTM Server Side <= 2.1.19 - Reflected Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
Stape Conversion Tracking banner
Latestv2.3.8

Stape Conversion Tracking

Stape

Author

Stape

5.0(4)
100/100
Last Updated
2026-09-03 (10d ago)
Active Installs
10,000+
Downloads
217,813
Requires WP
5.2.0+
Requires PHP
0+
Tested up to
WP 7.1.0
Created
2020-10-08 (6y ago)

If you are looking for the easiest way to implement server-side tracking on your WordPress website, the GTM Server Side plugin by stape.io is the best solution. It helps to easily modify the gtm script with the tagging server URL, adds a custom loader, and sends data layer events and webhooks. GTM Server Side plugin by stape.io features: Add web Google Tag Manager script on every website page. Work with any other WP plugin that inserts gtm script on the website. Adds custom loader, which makes Google Tag Manager and Google Analytics tracking invisible to ad blockers and other tracking prevention mechanisms. Sends events to GTM server side without any JS library and optimizes page speed. Adds e-commerce Data Layer events. Adds user data to Data Layer events. Sends webhooks. Provides the possibility to manage dynamic generation of data layer fields. Native Same Origin proxy. Benefits of GTM Server Side plugin by stape.io: Increase cookies lifetime when using a custom domain for server Google Tag Manager container. Increases the accuracy of tracking when the custom loader is enabled. Simplifies the process of adding GTM script on the website and delivering e-commerce and user data.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C