CVE-2026-105199

MediumCVSS 6.8

Published: 24/10/2026(UTC)Updated: 26/10/2026(UTC)Translated: 24/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

The Pixel Tag Manager for WooCommerce WordPress plugin before version 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard. This allows users with a role as low as Contributor to overwrite the plugin's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.

Risk Assessment

Low-privileged users can inject malicious JavaScript executed for all visitors, potentially leading to data theft, session hijacking, or browser infections.

Recommendation

Update the Pixel Tag Manager for WooCommerce plugin to version 2.2.3 or later. Check the tracking configuration for unauthorized changes.

Other vulnerabilities in Pixel Tag Manager for WooCommerce WordPress plugin

CVE-2026-14315Medium
The Pixel Tag Manager for WooCommerce WordPress plugin before version 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials.

Original NVD description (English source)

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS