Technical impact
The Pixel Tag Manager for WooCommerce plugin versions before 2.2.3 lack a capability check in one of its AJAX actions and expose the protecting nonce to any user who can reach the admin dashboard. This deficiency lets contributors overwrite the plugin’s tracking configuration and embed arbitrary JavaScript. When visitors—including administrators—load the site, the injected code runs in their browsers, enabling an attacker to hijack sessions, exfiltrate data, or deface the site locally. The primary impact is an unprivileged stored cross‑site scripting vulnerability that grants attackers wide‑scope code execution in client browsers.
Affected Systems
WordPress installations running the Pixel Tag Manager for WooCommerce plugin with a version older than 2.2.3. The product is managed by an unknown vendor and is used to integrate Google Tag Manager via a container ID. Any site hosting this plugin and permitting contributors to access the admin dashboard is affected.
Risk and Exploitability
The vulnerability is not catalogued in CISA’s KEV list and EPSS score is < 1%, but the ease of exploitation—any contributor with dashboard access—indicates a high risk. Without a published exploitation pattern, the exact likelihood is unclear, yet the combination of arbitrary code execution and the low access threshold makes it a serious, high‑consequence threat. CVSS score of 6.8 is provided, indicating a medium severity level, but the impact description warrants urgent remediation.
