CVE-2026-105199
Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID
CVSS Score
6.8
EPSS Score
0.2%
EPSS Percentile
10th
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.
| Vendor | unknown |
| Product | pixel tag manager for woocommerce |
| Published | Oct 24, 2026 |
| Last Updated | Oct 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown pixel tag manager for woocommerce
Be the first to know when new medium vulnerabilities affecting unknown pixel tag manager for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Pixel Tag Manager for WooCommerce
0 < 2.2.3
References
Credits
Suhayb Ahmed (cyboltx) WPScan