CVE-2026-94674

MediumCVSS 6.5

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

Cross Site Scripting (XSS) vulnerability in Pixel Manager for WooCommerce up to version 1.69.0. A user with Contributor role can inject malicious script.

Risk Assessment

An attacker can steal user sessions or take over accounts, leading to data integrity compromise.

Recommendation

Update the plugin to the latest version that includes the fix.

Other vulnerabilities in Pixel Manager for WooCommerce

CVE-2025-67564Medium
The Pixel Manager for WooCommerce plugin (woocommerce-google-adwords-conversion-tracking-tag) by alekv in versions up to, and including, 1.51.1 is vulnerable to exposure of sensitive system information to an unauthorized control sphere. This may allow retrieval of embedded sensitive data.

Original NVD description (English source)

Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS