Stored XSS in Pixel Tag Manager for WooCommerce plugin
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.
Summary
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions. This missing check lets a user with a role as low as Contributor overwrite the plugin's tracking configuration with a stored cross-site scripting payload (CWE-79). The injected JavaScript runs in the browsers of all visitors, including administrators. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Pixel Tag Manager for WooCommerce | before 2.2.3 | 2.2.3 | Patch available | CNA |
- Pixel Tag Manager for WooCommerce VendorUnknown Affected before 2.2.3 Fixed in 2.2.3 Patch available CNA
Remediation
Update Pixel Tag Manager for WooCommerce to version 2.2.3 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Pixel Tag Manager for WooCommerce (Unknown) Fixed in 2.2.3
Timeline
- 2026-10-24 Threatist record created from CVE-2026-105199
- 2026-10-24 Alias added: GHSA-w5mv-3wm8-fgrx
- 2026-10-24 CVSS score added · CISA ADP
- 2026-10-24 Weakness changed · CISA ADP
- 2026-10-24 CISA SSVC decision points changed
References
Sources
- CVE-2026-105199 · CVE Program
- CVE-2026-105199 · NVD
- FIRST EPSS
- GHSA-w5mv-3wm8-fgrx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences