Pixel Tag Manager EUVD-2026-109226

Requires an authenticated WordPress account with a role as low as Contributor that can access the admin dashboard (to read the exposed nonce); the site must run Pixel Tag Manager for WooCommerce before version 2.2.3. Exploitation also depends on a victim - an administrator or visitor - subsequently loading a page that renders the overwritten tracking configuration, so the injected JavaScript executes (UI:R). Limiting factors: it is not anonymous/unauthenticated (an attacker must already hold at least a Contributor account), and the payload only fires when a victim views the affected output rather than on demand.

This is a moderate-priority issue, not a top-tier emergency. The input CVSS of 6.8 reflects a network vector (AV:N) but is tempered by a privilege requirement and required user interaction (UI:R). Note a clear conflict in the data: the supplied vector lists PR:H, yet the description states exploitation is possible by a user 'with a role as low as Contributor' - Contributor is a low-privilege WordPress role, so PR:L is more accurate and the real barrier to entry is lower than PR:H implies. The supplied impact metrics (C:H/I:H/A:H with S:U) also look inflated for a nonce/capability-check stored-XSS flaw; the realistic impact is admin-session/account compromise via injected JavaScript rather than direct host-level CIA loss. Supporting signals point to limited near-term urgency: EPSS is low at 0.21% (10th percentile), the flaw is not in CISA KEV (no confirmed active exploitation), and only a non-verified PoC reference exists. The vuln.today decision label is 'this_month', consistent with a patch-this-cycle rather than drop-everything posture. Net: a genuine privilege-escalation-to-stored-XSS bug worth remediating within the month, elevated somewhat by the low real-world privilege barrier (Contributor) but held down by the need for an authenticated account and a victim loading the affected page.

An attacker who has obtained or registered a low-privilege Contributor account reads the AJAX nonce that the plugin exposes to any admin-dashboard user, then sends a crafted AJAX request to the unprotected action to overwrite the plugin's tracking configuration with malicious JavaScript. When an administrator or site visitor subsequently loads a page that renders the tracking config, the injected script runs in their browser, enabling session/account compromise. A public PoC reference exists (WPScan); it is not verified as working exploit code, and exploitation requires an authenticated account plus a victim loading the affected page.