Live › vulnerability › CVE-2026-105199
Go to dashboardThe Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 has an AJAX action with no capability check, and its nonce is exposed to any admin-dashboard user. A Contributor can overwrite the tracking configuration so arbitrary JavaScript runs in every visitor's browser, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running the Pixel Tag Manager for WooCommerce plugin before 2.2.3 with WooCommerce are exposed, as the flaw sits in the plugin's admin AJAX handler. Exposure depends on having any user who can reach the admin dashboard with a Contributor role or higher. Sites without this plugin, or running 2.2.3 or later, can skip it.
No product ranges from the sources yet.
2.2.3 are affected2.2.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-105199")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.