{"id":"CVE-2026-105199","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-105199","generatedAt":"2026-10-28T03:39:03.226Z","title":"The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as…","description":"The Pixel Tag Manager for WooCommerce  WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce  WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.","published":"2026-10-24T06:16:34.000Z","lastModified":"2026-10-26T13:50:14.000Z","status":"Deferred","sourceIdentifier":"contact@wpscan.com","cvss":{"version":"3.1","score":6.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-79"],"affected":[],"epss":{"score":0.00306,"percentile":0.23296,"date":"2026-10-27","history":[{"date":"2026-10-24","score":0.00208,"percentile":0.10348}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"scored","label":"Newly scored","at":"2026-10-24T16:47:29.000Z","detail":{"from":null,"score":"6.8","severity":"MEDIUM","fromSeverity":null},"summary":"Now scored CVSS 6.8 MEDIUM."},{"kind":"new","label":"New CVE","at":"2026-10-24T06:16:34.000Z","detail":{"score":null,"severity":null,"publishedAt":"2026-10-24T06:16:34.453Z"},"summary":"New CVE, medium severity (CVSS 6.8)."}],"references":[{"url":"https://wpscan.com/vulnerability/69d7c59c-77d1-422d-8ad7-6066dad59013/","source":"contact@wpscan.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-105199","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}