Medium severity · published Oct 24, 2026
CVE-2026-105199
Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID
New
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PT
Pixel Tag Manager for WooCommerce ·
before 2.2.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105199
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105199
wpscan.com
https://wpscan.com/vulnerability/69d7c59c-77d1-422d-8ad7-6066dad59013/
More from Pixel Tag Manager for WooCommerce
6.5
CVE-2026-14315
Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission