A cross‑site scripting vulnerability exists in versions of the WordPress Pixel Manager for WooCommerce plugin up to and including 1.69.0. The flaw allows a contributor or user with sufficient privileges to inject arbitrary JavaScript into the plugin’s output. Because the injected code runs in the context of the visitor’s browser, it can steal session cookies, deface the site, or redirect users to malicious sites. The underlying weakness is improper input validation and sanitization, categorized as CWE‑79.

The affected product is the Pixel Manager for WooCommerce plugin developed by SweetCode. All installations running version 1.69.0 or earlier are vulnerable. The vendor recommends updating to version 1.69.1 or newer which contains the fix.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, meaning no known widespread exploitation has been reported. The likely attack vector is through the plugin’s admin interface or URL parameters that accept user input, whereby a malicious contributor can inject payloads. Given the moderate score and lack of documented exploits, the risk is present but the likelihood of a successful attack depends on the presence of vulnerable users and the exposure of the affected plugin.