CVE-2025-67564
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Pixel Manager for WooCommerce plugin (woocommerce-google-adwords-conversion-tracking-tag) by alekv in versions up to, and including, 1.51.1 is vulnerable to exposure of sensitive system information to an unauthorized control sphere. This may allow retrieval of embedded sensitive data.
Risk Assessment
An unauthorized party may gain access to sensitive data embedded in the system, potentially leading to a confidentiality breach. The risk depends on the type of exposed information and how it could be used.
Recommendation
Update the Pixel Manager for WooCommerce plugin to a version newer than 1.51.1. Review what data is embedded and whether it contains sensitive information.
Other vulnerabilities in Pixel Manager for WooCommerce
See all- CVE-2026-94674Medium
Cross Site Scripting (XSS) vulnerability in Pixel Manager for WooCommerce up to version 1.69.0. A user with Contributor role can inject malicious script.
- CVE-2025-12545Medium
The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 1.49.2 via the ajax_pmw_get_product_ids() function. Due to insufficient restrictions on which products can be included, unauthenticated attackers can extract data from password-protected, private, or draft products.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in alekv Pixel Manager for WooCommerce woocommerce-google-adwords-conversion-tracking-tag allows Retrieve Embedded Sensitive Data.This issue affects Pixel Manager for WooCommerce: from n/a through <= 1.51.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS