MEDIUMCVSS v3.1 6.8Vulnerability
CVE-2026-105199
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-25T06:45:46.319867+00:00
- Cvss severity
- MEDIUM
- Cvss score
- 6.8
- Epss score
- 0.00208
- Retrieved at
- 2026-10-25T06:47:46+00:00
- Last source
- FIRST EPSS
- Score
- 6.8
- Cvss version
- 3.1
- Cve id
- CVE-2026-105199
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-10-24T06:35:11+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- Published at
- 2026-10-24T06:16:34.453
- Last modified
- 2026-10-24T15:16:49.687
- Epss percentile
- 0.10348
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph