Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105199— Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID

Quick assessment

Affected
Unknown Pixel Tag Manager for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WooCommerce 的 Pixel Tag Manager WordPress 插件在 2.2.3 版本之前，其某个 AJAX 操作未执行能力（capability）检查，并将用于保护该操作的 nonce 暴露给任何能够访问管理仪表板的用户。这使得角色低至“投稿者（Contributor）”的用户也能覆盖 Pixel Tag Manager for WooCommerce 插件（2.2.3 之前版本）的跟踪配置，并在所有访客（包括管理员）的浏览器中执行任意 JavaScript 代码。

AI Predicted 8.8 Difficulty: Easy
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105199

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID
Source: CVE Program / CVE List V5
Vulnerability Description
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Pixel Tag Manager for WooCommerce 0 ~ 2.2.3 -

II. Public POCs for CVE-2026-105199

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105199

请登录查看更多情报信息。

Same Patch Batch · Unknown · 2026-10-24 · 16 CVEs total

CVE-2026-114429 WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content
CVE-2026-113674 GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
CVE-2026-113673 GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
CVE-2026-113493 GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
CVE-2026-112207 Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link
CVE-2026-113489 GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
CVE-2026-113490 GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup RE
CVE-2026-113492 GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed
CVE-2026-113491 GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
CVE-2026-110956 asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation
CVE-2026-87835 Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assig
CVE-2026-107887 Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_th
CVE-2026-107907 MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist
CVE-2026-97352 News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via
CVE-2026-97353 News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_

IV. Related Vulnerabilities

Same product: Pixel Tag Manager for WooCommerce
Same vendor: Unknown

V. Comments for CVE-2026-105199

No comments yet

Leave a comment