The Pixel Tag Manager for WooCommerce plugin versions before 2.2.3 lacks a capability check in one of its AJAX actions and exposes the protecting nonce to any user who can reach the admin dashboard. This deficiency lets contributors overwrite the plugin’s tracking configuration and embed arbitrary JavaScript. When visitors—including administrators—load the site, the injected code runs in their browsers, enabling an attacker to hijack sessions, exfiltrate data, or deface the site locally. The primary impact is an unprivileged stored cross‑site scripting vulnerability that grants attackers wide‑scope code execution in client browsers.

WordPress installations running the Pixel Tag Manager for WooCommerce plugin with a version older than 2.2.3. The product is managed by an unknown vendor and is used to integrate Google Tag Manager via a container ID. Any site hosting this plugin and permitting contributors to access the admin dashboard is affected.

The vulnerability is not catalogued in CISA’s KEV list and no EPSS score is available, but the ease of exploitation—any contributor with dashboard access—indicates a high risk. Without a published exploitation pattern, the exact likelihood is unclear, yet the combination of arbitrary code execution and the low access threshold makes it a serious, high‑consequence threat. No CVSS score is provided, so the exact numeric severity remains unspecified, but the impact description warrants urgent remediation.