CVE-2025-6201

Pixel Manager for WooCommerce (PRO) <= 1.49.0 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode

Published Jun 19, 2025 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's conversion-pixel in all versions up to, and including, 1.49.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

Technical impact

The Pixel Manager for WooCommerce plugin contains a stored cross‑site scripting vulnerability in its conversion‑pixel shortcodes. When a contributor or higher user supplies unsanitized attribute values, those values are rendered without proper escaping, enabling the attacker to inject arbitrary JavaScript. Executed scripts run in the context of any visitor who loads the affected page, potentially compromising user credentials, hijacking sessions, or redirecting traffic.

Affected Systems

The vulnerability affects the WordPress plugin Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing. All released versions up to and including 1.49.0 are affected. Any WordPress site running one of these versions, with an authenticated contributor‑level user, is at risk.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. It requires a contributor‑level or higher role to inject the malicious attribute, and the impact is felt by any visitor who loads the page where the stored script runs.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

alekv

Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.49.0

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Pixel Manager for WooCommerce to the latest released version, ensuring it is newer than 1.49.0.
If an upgrade is not immediately possible, restrict contributor-level access to the plugin or remove shortcodes that allow attribute injection until a patch is applied.
As a short‑term measure, modify the shortcode settings to block custom attribute input or replace the plugin's shortcodes with sanitized versions.
Implement site‑wide input validation and output escaping best practices, ensuring any user‑supplied value in shortcodes is sanitized before rendering.

Generated by OpenCVE AI on April 22, 2026 at 14:48 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-28701	The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's conversion-pixel in all versions up to, and including, 1.49.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.292% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/woocommerce-google-adwords-conversion-tracking-tag/trunk/includes/pixels/class-shortcodes.php#L289
https://plugins.trac.wordpress.org/changeset/3313714/woocommerce-google-adwords-conversion-tracking-tag/trunk/includes/pixels/class-shortcodes.php
https://wordpress.org/plugins/woocommerce-google-adwords-conversion-tracking-tag/
https://www.wordfence.com/threat-intel/vulnerabilities/id/170a4cf2-d379-4c4e-b9e5-fb3b3bd91a40?source=cve

History

Jun 20, 2025 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 19, 2025 2:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's conversion-pixel in all versions up to, and including, 1.49.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title		Pixel Manager for WooCommerce (PRO) <= 1.49.0 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/browser/woocommerce-google-adwords-conversion-tracking-tag/trunk/includes/pixels/class-shortcodes.php#L289 https://plugins.trac.wordpress.org/changeset/3313714/woocommerce-google-adwords-conversion-tracking-tag/trunk/includes/pixels/class-shortcodes.php https://wordpress.org/plugins/woocommerce-google-adwords-conversion-tracking-tag/ https://www.wordfence.com/threat-intel/vulnerabilities/id/170a4cf2-d379-4c4e-b9e5-fb3b3bd91a40?source=cve
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`