The Pixel Manager for WooCommerce plugin contains a stored cross‑site scripting vulnerability in its conversion‑pixel shortcodes. When a contributor or higher user supplies unsanitized attribute values, those values are rendered without proper escaping, enabling the attacker to inject arbitrary JavaScript. Executed scripts run in the context of any visitor who loads the affected page, potentially compromising user credentials, hijacking sessions, or redirecting traffic.

The vulnerability affects the WordPress plugin Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing. All released versions up to and including 1.49.0 are affected. Any WordPress site running one of these versions, with an authenticated contributor‑level user, is at risk.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. It requires a contributor‑level or higher role to inject the malicious attribute, and the impact is felt by any visitor who loads the page where the stored script runs.