Handl Utm Grabber Vulnerabilities

The HandL UTM Grabber / Tracker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a...

CVSS:

7.2

Affected:

up to 2.9.2

Fixed in:

2.9.3

Disclosed:

Jul 1, 2026

CVE-2026-57351 on NVD →

[en] The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected:

up to 2.8.1

Fixed in:

2.8.1

Disclosed:

Dec 10, 2025

CVE-2025-13073 on NVD →

[en] The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Affected:

up to 2.8.1

Fixed in:

2.8.1

Disclosed:

Dec 10, 2025

CVE-2025-13072 on NVD →

The HandL UTM Grabber / Tracker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can...

CVSS:

6.1

Affected:

up to 2.8.0

Fixed in:

2.8.1

Disclosed:

Nov 19, 2025

CVE-2025-13073 on NVD →

The HandL UTM Grabber / Tracker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can...

CVSS:

6.1

Affected:

up to 2.8.0

Fixed in:

2.8.1

Disclosed:

Nov 19, 2025

CVE-2025-13072 on NVD →

[en] The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.

Affected:

up to 2.6.5

Fixed in:

2.6.5

Disclosed:

Aug 29, 2019

CVE-2019-15769 on NVD →

The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.

CVSS:

8.8

Affected:

up to 2.6.5

Fixed in:

2.6.5

Disclosed:

Aug 27, 2019

CVE-2019-15769 on NVD →