{"id":"CVE-2026-105199","kind":"vulnerability","aliases":["CVE-2026-105199"],"related":[],"title":"Pixel Tag Manager for WooCommerce: low-privilege users can inject JavaScript sitewide","description":"The Pixel Tag Manager for WooCommerce  WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce  WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.","summary":"The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 has an AJAX action with no capability check, and its nonce is exposed to any admin-dashboard user. A Contributor can overwrite the tracking configuration so arbitrary JavaScript runs in every visitor's browser, including administrators.","severity":"high","cvss":null,"epss":0.00208,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pixel-tag-manager","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-2.2.3-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the Pixel Tag Manager for WooCommerce plugin in the WordPress admin Plugins screen; versions below `2.2.3` are affected\n- Review user accounts with Contributor or higher roles that you do not fully trust","fix":"- Update Pixel Tag Manager for WooCommerce to `2.2.3` or later\n- Until updated, remove or restrict Contributor-and-above accounts you do not trust","status":"open","published_at":"2026-10-24T06:16:34+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","triaged_at":"2026-10-25T04:52:01+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:52:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update Pixel Tag Manager for WooCommerce to `2.2.3` or later\n- Until updated, remove or restrict Contributor-and-above accounts you do not trust","reach":"internet","title":"Pixel Tag Manager for WooCommerce: low-privilege users can inject JavaScript sitewide","impact":"high","summary":"The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 has an AJAX action with no capability check, and its nonce is exposed to any admin-dashboard user. A Contributor can overwrite the tracking configuration so arbitrary JavaScript runs in every visitor's browser, including administrators.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","pixel-tag-manager","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary JavaScript in all visitors' browsers, including admins","analyst_note":"Confirm the affected version range and the exact vulnerable AJAX action name from the NVD entry or the plugin changelog.","how_to_check":"- Check the installed version of the Pixel Tag Manager for WooCommerce plugin in the WordPress admin Plugins screen; versions below `2.2.3` are affected\n- Review user accounts with Contributor or higher roles that you do not fully trust","needs_analyst":true,"not_affected_if":["plugin-2.2.3-or-later","plugin-not-installed"],"who_is_affected":"Sites running the Pixel Tag Manager for WooCommerce plugin before 2.2.3 with WooCommerce are exposed, as the flaw sits in the plugin's admin AJAX handler. Exposure depends on having any user who can reach the admin dashboard with a Contributor role or higher. Sites without this plugin, or running 2.2.3 or later, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":3385,"output_tokens":689,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105199':16A,19A '-2026':15A,18A '2.2.3':39B,86C,134C 'abl':108C 'access':110C 'action':43B,98C 'admin':56B,112C 'admin-dashboard':55B 'administr':76B,150C 'ajax':42B,97C 'allow':114C 'arbitrari':67B,140C 'browser':74B,145C 'capabl':46B,91C 'check':47B,92C 'configur':65B,137C 'contributor':60B,122C 'cve':14A,17A 'dashboard':57B,113C 'everi':71B 'execut':142C 'expos':52B,100C 'host':27B 'includ':75B,149C 'inject':11A 'javascript':12A,68B,141C 'low':7A,120C 'low-privileg':6A 'manag':3A,24B,33B,80C,128C 'nonc':50B,102C 'one':94C 'overwrit':62B,124C 'packag':20B 'perform':89C 'pixel':1A,22B,31B,78C,126C 'pixel-tag-manag':21B 'plugin':37B,84C,132C 'privileg':8A 'protect':103C 'role':118C 'run':69B 'self':26B 'self-host':25B 'sitewid':13A 'tag':2A,23B,32B,79C,127C 'track':64B,136C 'user':9A,58B,107C,115C 'visitor':72B,148C 'woocommerc':5A,28B,35B,82C,130C 'wordpress':29B,36B,83C,131C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Pixel Tag Manager for WooCommerce plugin before 2.2.3 with WooCommerce are exposed, as the flaw sits in the plugin's admin AJAX handler. Exposure depends on having any user who can reach the admin dashboard with a Contributor role or higher. Sites without this plugin, or running 2.2.3 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T06:16:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105199","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105199","severity":null,"published_at":"2026-10-24T06:16:34+00:00","modified_at":"2026-10-24T06:16:34+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","fetched_at":"2026-10-24T06:47:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-105199","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105199","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}