# Tracking Code Manager

> A plugin to manage ALL of your tracking code and conversion pixels. Compatible with Facebook Ads, Google Adwords, WooCommerce, Easy Digital Downloads, …

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 11:24 UTC.

## Facts (WordPress.org)

- Slug: `tracking-code-manager`
- Author: Data443 Risk Mitigation, Inc.
- Version: 2.8.0
- Active installs: 90,000+
- Last update: 2026-08-20 (3 months ago)
- Tested up to: WordPress 7.0.8 (current: 7.1.4)
- Requires: WordPress 3.6.0, PHP 5.6
- Tags: deliver content by ad, map google ads, profit google ad, track google ad, UTM management
- Page: https://wordpress.org/plugins/tracking-code-manager/

## Checks (against WordPress 7.1.4)

- OK: Updated 3 months ago.
- FLAG: Not tested with WordPress 7.1 (tested up to 7.0.8).
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Breaking ↔ Smooth, Phones home ↔ Private, Slow ↔ Responsive, Heavy ↔ Light, Paywalled ↔ Generous, Cluttered ↔ Clean.

## Known vulnerabilities

- 2026-10-15 MEDIUM: Reflected Cross-Site Scripting via 'TCM_ErrorMessages' (up to 2.6.0). CVE-2026-15180, https://www.wordfence.com/threat-intel/vulnerabilities/id/8f7ee196-1151-4312-ac61-0bb6756850bb?source=api-prod
- 2026-08-06 MEDIUM: Cross-Site Request Forgery (up to 2.6.0). CVE-2026-28172, https://www.wordfence.com/threat-intel/vulnerabilities/id/d6879547-4a5f-48af-a3af-7e13c941b4bf?source=api-prod
- 2025-01-30 MEDIUM: Cross-Site Scripting (before 2.4.0). CVE-2024-10309, https://wpscan.com/vulnerability/9eb21250-34bd-4600-a0a5-7c5117f69f04/
- 2024-12-23 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.3.0). CVE-2024-8721, https://www.wordfence.com/threat-intel/vulnerabilities/id/443d2e80-31db-40ac-9c35-88eec841ebba?source=api-prod
- 2024-06-03 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 2.2.0). CVE-2024-6335, https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd1fe45-8518-429b-94d3-cc0ea06ca1b4?source=api-prod
- 2024-04-05 MEDIUM: Missing Authorization via change_order() (up to 2.1.0). CVE-2024-31347, https://www.wordfence.com/threat-intel/vulnerabilities/id/0d54e5ad-0a97-4dd4-b53b-ad3f885dc506?source=api-prod
- 2024-03-18 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 2.0.16). CVE-2024-2579, https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c962ba-43ef-4713-acd9-1e499f857df8?source=api-prod
- 2017-05-10 MEDIUM: Cross-Site Scripting (up to 1.11.4). WF-8f52fd57-abfe-48c4-a950-66d72a5a9627, https://www.wordfence.com/threat-intel/vulnerabilities/id/8f52fd57-abfe-48c4-a950-66d72a5a9627?source=api-prod
- 2017-05-10 HIGH: Denial of Service (up to 1.11.4). WF-99418bd5-041a-4210-9571-fee6842fb692, https://www.wordfence.com/threat-intel/vulnerabilities/id/99418bd5-041a-4210-9571-fee6842fb692?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=tracking-code-manager · HTML: https://todaywp.com/plugins/tracking-code-manager