Skip to content
PluginCanary

Tracking Code Manager

by Data443 Risk Mitigation, Inc. · 90,000+ active installs · Checked 3 Nov 2026
Healthy1 Warning

Healthy: vulnerability published 14 Oct 2026, fixed in 2.7.0.

86/ 100 Canary Score
Sub-scores for Tracking Code Manager
Ownership100
Maintenance100
Security85
Support70
Reputation60

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 14 Oct 2026, fixed in 2.7.0. Update to version 2.7.0 or later.14 Oct 2026Evidence
  • InfoSEC-33 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence
  • InfoMOM-2Downloads in the last 4 weeks are down more than half vs the 26-week average. Review this plugin.3 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
IntellyWP7 Apr 2015 to 22 Jul 2021, 100 commits
data44319 Aug 2021 to 20 Aug 2026, 42 commits

2 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
3 months ago
Releases, 24 months
5
Tested up to
7.0 vs 7.1
Requires PHP
5.6 supported 8.2+
Releases per quarter for Tracking Code Manager
Q1 20242
Q2 20240
Q3 20241
Q4 20241
Q1 20250
Q2 20251
Q3 20250
Q4 20250
Q1 20260
Q2 20261
Q3 20262
Q4 20260

Last release 20 Aug 2026. Tested up to 7.0, 1 major version behind WordPress 7.1.

Support

0% of 1 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
14 Oct 2026Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'6.1<= 2.6.02.7.00
5 Aug 2026Tracking Code Manager <= 2.6.0 - Cross-Site Request Forgery4.3<= 2.6.02.7.00
23 Dec 2024Tracking Code Manager <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 2.3.02.4.00
3 Jun 2024Tracking Code Manager <= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 2.2.02.3.031
5 Apr 2024Tracking Code Manager <= 2.1.0 - Missing Authorization via change_order()4.3<= 2.1.02.2.00
18 Mar 2024Tracking Code Manager <= 2.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 2.0.162.1.00
10 May 2017Tracking Code Manager < 1.11.5 - Denial of Service7.5<= 1.11.41.11.5n/a
10 May 2017Tracking Code Manager < 1.11.5 - Cross-Site Scripting6.1<= 1.11.41.11.5n/a

Source: Wordfence Intelligence.

Reputation

Lifetime rating 4.1 from 58 ratings. Quarterly trends appear as new reviews arrive.

Rating distribution
5 star42
4 star3
3 star0
2 star1
1 star12
Latest low reviews

Momentum

90,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Tracking Code Manager
4 May 2026480
11 May 20261,044
18 May 2026899
25 May 202629,208
1 Jun 20265,506
8 Jun 20263,845
15 Jun 20263,114
22 Jun 20262,708
29 Jun 20262,424
6 Jul 20266,314
13 Jul 20262,166
20 Jul 20262,279
27 Jul 20262,202
3 Aug 202636,048
10 Aug 20267,689
17 Aug 202635,118
24 Aug 20268,029
31 Aug 20264,605
7 Sep 20263,435
14 Sep 20263,368
21 Sep 20263,070
28 Sep 20262,448
5 Oct 20262,776
12 Oct 20262,404
19 Oct 20263,057
26 Oct 20262,646
2 Nov 2026375

Weekly downloads over the last 4 weeks are 68% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Shortcoder - Create Shortcodes for AnythingScore 92 · 100,000+FluentSnippets - High-Performance Code Snippets, Header & Footer Code, Custom CSS & PHP Code ManagerScore 92 · 50,000+Simple Custom CSS and JSScore 91 · 600,000+Insert Headers And FootersScore 91 · 200,000+Visual CSS Style EditorScore 91 · 30,000+

Facts

Version2.8.0
AuthorData443 Risk Mitigation, Inc.
Added7 Apr 2015
Last updated20 Aug 2026
Active installs90,000+
Requires WordPress3.6.0
Tested up to7.0.8
Requires PHP5.6
CategoryE-commerce & Shopping > Shopping Cart & Checkout
Tagsmap google ads, UTM management, track google ad, profit google ad, deliver content by ad

Other plugins by this author: Inline Related Posts, The GDPR Framework By Data443, Evergreen Countdown Timer, Gravity Forms: GDPR Framework Add-On, LGPD Framework By Data443, GDPR Framework Add-on for Formidable Forms, Ninja Forms: GDPR Framework Add-On, Welcome Bar, Posts Footer Manager, The CCPA Framework By Data443, Data443 Anti-Spam

Questions

Is Tracking Code Manager still maintained?

Tracking Code Manager was last updated on 20 Aug 2026. Its Canary status is Healthy.

Is Tracking Code Manager safe?

Tracking Code Manager has no open unpatched vulnerabilities on record. 3 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns Tracking Code Manager?

The wordpress.org author is Data443 Risk Mitigation, Inc.. Recent committers: data443, IntellyWP, plugin-master. We have recorded no ownership change.

What can I use instead of Tracking Code Manager?

Plugins in the same category with a higher Canary Score: Shortcoder - Create Shortcodes for Anything, FluentSnippets - High-Performance Code Snippets, Header & Footer Code, Custom CSS & PHP Code Manager, Simple Custom CSS and JS, Insert Headers And Footers, Visual CSS Style Editor.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue