PT-2026-122497

CVE-2026-105199

Published

2026-10-24

Updated

2026-10-24

Description by

CVSS 3.1

6.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pixel Tag Manager for WooCommerce versions prior to 2.2.3

Description An issue exists where a capability check is missing in an AJAX action. The nonce protecting this action is exposed to any user with access to the admin dashboard. This allows users with roles as low as Contributor to overwrite the tracking configuration, leading to the execution of arbitrary JavaScript in the browsers of all visitors, including administrators. A nonce is a unique token used to protect against cross-site request forgery (CSRF) attacks.

Recommendations Update Pixel Tag Manager for WooCommerce to version 2.2.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Suhayb Ahmed

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers