WooCommerce Pixel Manager CVE-2026-94674

Requires an authenticated WordPress account with at least Contributor role (PR:L) on a site running Pixel Manager for WooCommerce version 1.69.0 or earlier, and requires a higher-privileged user (e.g. administrator) to subsequently view the injected content, satisfying the UI:R requirement. Limiting factors: exploitation is not possible anonymously - a Contributor account must first be obtained (self-registration enabled, compromised credentials, or an insider); the payload only achieves impact when a victim loads the affected admin/front-end view; and WooCommerce plus this specific tracking plugin must both be installed and active. This is not a default-configuration unauthenticated flaw.

This is a moderate-severity, low-real-world-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L = 6.5) describes a network-reachable but authenticated XSS: the attacker needs at minimum WordPress Contributor-level privileges (PR:L, consistent with the description's 'Contributor Cross Site Scripting'), the victim must interact (UI:R), and impact across all three dimensions is only Low, elevated to 6.5 only by the scope change (S:C) inherent to XSS crossing into the browser/other-user security context. There is no EPSS score, no CISA KEV listing, and no public exploit code provided in the intelligence - so the exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The single reference is a Patchstack database entry (Patchstack being the reporting/coordinating source), which lends confidence to the version boundary and vulnerability class but provides no technical sink/parameter detail. Net: a real but low-urgency vulnerability - its exploitation is gated behind an existing trusted-ish account (Contributor) plus social engineering of a victim, making it far less pressing than an unauthenticated (PR:N) XSS despite the identical CVSS band.

A WordPress user holding Contributor privileges on a site running Pixel Manager for WooCommerce <= 1.69.0 submits a crafted payload into a plugin-controlled input that is stored/reflected without adequate output encoding. When an administrator or other higher-privileged user later views that content in wp-admin, the injected JavaScript executes in their authenticated session, enabling session/cookie theft or admin actions on their behalf. No public proof-of-concept was identified in the provided data, and successful exploitation requires the victim to load the affected page (UI:R).