---
id: "CVE-2026-105199"
kind: "vulnerability"
aliases: ["CVE-2026-105199"]
title: "Pixel Tag Manager for WooCommerce: low-privilege users can inject JavaScript sitewide"
severity: "high"
cvss: null
epss: 0.00208
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "pixel-tag-manager", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-2.2.3-or-later", "plugin-not-installed"]
published_at: "2026-10-24T06:16:34+00:00"
first_seen_at: "2026-10-24T06:47:03+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105199", "first_seen_at": "2026-10-24T06:47:03+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-105199", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Pixel Tag Manager for WooCommerce: low-privilege users can inject JavaScript sitewide

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 has an AJAX action with no capability check, and its nonce is exposed to any admin-dashboard user. A Contributor can overwrite the tracking configuration so arbitrary JavaScript runs in every visitor's browser, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Pixel Tag Manager for WooCommerce plugin in the WordPress admin Plugins screen; versions below `2.2.3` are affected
- Review user accounts with Contributor or higher roles that you do not fully trust

## Fix

- Update Pixel Tag Manager for WooCommerce to `2.2.3` or later
- Until updated, remove or restrict Contributor-and-above accounts you do not trust

## Timeline

- 2026-10-24T06:47:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105199
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-105199

## From the sources

The Pixel Tag Manager for WooCommerce  WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce  WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_