PT-2026-122497
CVE-2026-105199
·
Published
2026-10-24
·
Updated
2026-10-24
Description by
CVSS 3.1
6.8
MediumMetricsAV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾