◆ CVE Hub

CVE-2026-105199

SSVC: none

Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID

Published
2026-10-24
Last modified
2026-10-24
CNA
WPScan
NVD status
Received
CWE
CWE-79

Fetching some sources has been requested. Reload in about a minute to see them.

CVSS v3.1 (listed by NVD)
6.8
MEDIUM
Scored by CISA-ADP (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
0.2%
Percentile 10.3%
as of 2026-10-24
CISA KEV
—
Not listed
SSVC (CISA ADP)
none
Automatable: no / Impact: total

Attack conditions and impact

Derived from the CISA-ADP (via NVD) CVSS 3.1 vector
NetworkAdminUser action Confidentiality HIntegrity HAvailability H
MetricValueMeaning
Attack vector AVNNetwork
Attack complexity ACLLow (easy)
Privileges required PRHAdministrator
User interaction UIRRequired
Scope SUUnchanged
Confidentiality CHHigh
Integrity IHHigh
Availability AHHigh
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Description

NVD

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.

CVSS assessments

ProviderVersionScoreVector
NVD / 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)3.16.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
ADP / CISA-ADP3.16.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Affected products and packages

CNA (CVE.org)

VendorProductVersions
UnknownPixel Tag Manager for WooCommerce
affected: 0 … < 2.2.3
default: unaffected

Linux distribution status

Red Hat ↗ Fetching

Debian ↗

No record

Ubuntu ↗ Fetching

References (1)