CVE-2026-105199: Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pixel Tag Manager for WooCommerceto a version that resolves this vulnerability.Fixed in 2.2.3
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user who can access the WordPress admin dashboard, including a Contributor-level user, can access the nonce and invoke the affected AJAX action. The action lacks the capability check needed to restrict configuration changes.
What is the impact of successful exploitation?
An attacker can overwrite the plugin's tracking configuration and inject arbitrary JavaScript. That JavaScript executes in the browsers of site visitors, including WordPress administrators.
Are unauthenticated visitors able to trigger the vulnerable action directly?
The described attack requires a user who can access the WordPress admin dashboard. The data does not indicate that unauthenticated users can invoke the affected AJAX action.
How can I determine whether my site is affected?
Check whether Pixel Tag Manager for WooCommerce is installed and running a version earlier than 2.2.3. Also review the plugin's tracking configuration for unexpected changes, particularly its Google Tag Manager container ID or other injected tracking settings.