CVE-2025-6201: Pixel Manager for WooCommerce XSS Vulnerability

CVE-2025-6201 Overview

CVE-2025-6201 is a Stored Cross-Site Scripting (XSS) vulnerability in the Pixel Manager for WooCommerce WordPress plugin. The flaw affects all versions up to and including 1.49.0. It stems from insufficient input sanitization and output escaping on user-supplied attributes processed by the plugin's conversion-pixel shortcode.

Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads the affected page. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can plant persistent JavaScript payloads that execute against site visitors and administrators, enabling session theft, redirection, and administrative account takeover.

Affected Products

Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more
All plugin versions up to and including 1.49.0
WordPress sites running WooCommerce with the affected plugin installed

Discovery Timeline

2025-06-19 - CVE-2025-6201 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6201

Vulnerability Analysis

The plugin registers a conversion-pixel shortcode handled in includes/pixels/class-shortcodes.php. When rendering the shortcode, the plugin reads attributes supplied by the content author and emits them into the resulting HTML without proper sanitization or output escaping.

Because WordPress permits contributors to author posts that may contain shortcodes, any user at contributor level or above can embed the shortcode with attacker-controlled attributes. The injected markup is stored in post content and rendered every time the page is viewed, producing a persistent (stored) XSS condition.

The attack requires authenticated access, and the impact crosses trust boundaries because the injected script executes in the security context of the site's origin against any viewer, including administrators. See the Wordfence Vulnerability Analysis for detailed technical breakdown.

Root Cause

The root cause is missing input sanitization on shortcode attributes and missing output escaping when those attributes are emitted into HTML. Neither sanitize_text_field() on input nor esc_attr() / esc_html() on output was applied to attacker-controlled attribute values in the affected code path. Review the WordPress Shortcodes Class Code for the vulnerable location.

Attack Vector

An authenticated attacker with contributor privileges authors a post or page containing the conversion-pixel shortcode. The attacker crafts one or more shortcode attributes containing HTML event handlers or <script> fragments. When the post is published or previewed and later viewed by another user, the browser parses and executes the injected script. Consult the vendor's WordPress Plugin Overview for feature context.

Exploitation of the stored payload can steal authentication cookies, perform actions in the victim's session, deface pages, or pivot to administrator account compromise if an administrator loads the affected content.

Detection Methods for CVE-2025-6201

Indicators of Compromise

Post or page content containing [conversion-pixel ...] shortcodes with attributes holding <script>, onerror=, onload=, javascript:, or encoded JavaScript payloads
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading published content
New or modified WordPress administrator accounts following contributor activity on affected sites

Detection Strategies

Audit the wp_posts table for shortcode invocations of conversion-pixel and inspect attribute values for HTML tags, quote-breaking characters, or event-handler syntax
Review contributor and author activity logs for unusual post creation or edits coinciding with the vulnerability window
Deploy a web application firewall rule that blocks shortcode attribute values containing script tags or on-event handlers targeting the WooCommerce admin surface

Monitoring Recommendations

Monitor WordPress role changes, plugin installations, and privilege escalations across the site
Alert on Content Security Policy (CSP) violation reports indicating inline script execution on pages that should not contain scripts
Track anomalous session activity such as administrator logins from new geographies immediately after content is viewed

How to Mitigate CVE-2025-6201

Immediate Actions Required

Update the Pixel Manager for WooCommerce plugin to a version later than 1.49.0 that includes the fix from WordPress Changeset #3313714
Review all existing posts and pages for malicious conversion-pixel shortcode instances and remove attacker-controlled content
Rotate credentials and invalidate active sessions for any administrator accounts that may have viewed affected pages

Patch Information

The vendor addressed the flaw in a version released after 1.49.0. The fix is committed in WordPress Changeset #3313714, which adds proper sanitization and escaping to shortcode attribute handling in class-shortcodes.php. Administrators should apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

Restrict contributor-level and above accounts to trusted users only until the patch is applied
Temporarily deactivate the Pixel Manager for WooCommerce plugin if immediate patching is not possible
Deploy a Content Security Policy that disallows inline scripts and unauthorized external script sources to limit XSS payload execution

bash

# Update the affected plugin using WP-CLI
wp plugin update woocommerce-google-adwords-conversion-tracking-tag

# Verify the installed version is greater than 1.49.0
wp plugin get woocommerce-google-adwords-conversion-tracking-tag --field=version

# If patching is delayed, deactivate the plugin
wp plugin deactivate woocommerce-google-adwords-conversion-tracking-tag