CVE-2026-94674
MediumCVSS 6.5Summary
Cross Site Scripting (XSS) vulnerability in Pixel Manager for WooCommerce up to version 1.69.0. A user with Contributor role can inject malicious script.
Risk Assessment
An attacker can steal user sessions or take over accounts, leading to data integrity compromise.
Recommendation
Update the plugin to the latest version that includes the fix.
Other vulnerabilities in Pixel Manager for WooCommerce
See all- CVE-2025-67564Medium
The Pixel Manager for WooCommerce plugin (woocommerce-google-adwords-conversion-tracking-tag) by alekv in versions up to, and including, 1.51.1 is vulnerable to exposure of sensitive system information to an unauthorized control sphere. This may allow retrieval of embedded sensitive data.
- CVE-2025-12545Medium
The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 1.49.2 via the ajax_pmw_get_product_ids() function. Due to insufficient restrictions on which products can be included, unauthenticated attackers can extract data from password-protected, private, or draft products.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS