Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing
woocommerce-google-adwords-conversion-tracking-tag · plugin
Known security vulnerabilities for Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing. Find out in seconds which version runs on your site with WP Lens.
4 known vulnerabilities
2 exploitable without logging in · latest Sep 30, 2026
Listed on wordpress.org · latest 1.69.1 · last updated Sep 23, 2026 · 40K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- Medium 6.5
CVE-2026-94674contributor+≤ 1.69.0
WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability
- Medium 6.4
CVE-2025-6201contributor+≤ 1.49.0
Pixel Manager for WooCommerce (PRO) <= 1.49.0 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode
- Medium 5.3
CVE-2025-67564unauthenticated≤ 1.51.1
WordPress Pixel Manager for WooCommerce plugin <= 1.51.1 - Sensitive Data Exposure vulnerability
- Medium 5.3
CVE-2025-12545unauthenticated≤ 1.49.2
Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more <= 1.49.2 - Unauthenticated Information Exposure
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).