CVE-2026-94674: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in SweetCode Pixel Manager for WooCommerce
CVE-2026-94674 is a cross-site scripting (XSS) vulnerability in SweetCode's Pixel Manager for WooCommerce affecting versions up to and including 1.69.0. This vulnerability involves improper neutralization of input during web page generation, allowing an attacker with limited privileges to execute script code in the context of other users. The CVSS score is 6.5, indicating a medium severity with potential impacts on confidentiality, integrity, and availability. No patch or remediation details are currently provided.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-94674) is a CWE-79 cross-site scripting flaw in Pixel Manager for WooCommerce versions up to 1.69.0. It allows an attacker with low privileges to inject malicious scripts due to improper input neutralization during web page generation. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and impacts on confidentiality, integrity, and availability with scope change.
Potential Impact
An attacker with limited privileges can exploit this XSS vulnerability to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, modification of data, or disruption of service. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit user privileges and monitor for suspicious activity related to web input handling.
CVE-2026-94674: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in SweetCode Pixel Manager for WooCommerce
Description
CVE-2026-94674 is a cross-site scripting (XSS) vulnerability in SweetCode's Pixel Manager for WooCommerce affecting versions up to and including 1.69.0. This vulnerability involves improper neutralization of input during web page generation, allowing an attacker with limited privileges to execute script code in the context of other users. The CVSS score is 6.5, indicating a medium severity with potential impacts on confidentiality, integrity, and availability. No patch or remediation details are currently provided.
CVSS v3.1
Score 6.5medium
Affected software
SweetCode
Pixel Manager for WooCommerce
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-94674) is a CWE-79 cross-site scripting flaw in Pixel Manager for WooCommerce versions up to 1.69.0. It allows an attacker with low privileges to inject malicious scripts due to improper input neutralization during web page generation. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and impacts on confidentiality, integrity, and availability with scope change.
Potential Impact
An attacker with limited privileges can exploit this XSS vulnerability to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, modification of data, or disruption of service. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit user privileges and monitor for suspicious activity related to web input handling.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Patchstack
- Date Reserved
- 2026-09-22T00:19:50.791Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abd08c02a4e24523d068e74
Added to database: 09/30/2026, 13:04:00 UTC
Last enriched: 09/30/2026, 13:34:18 UTC
Last updated: 10/01/2026, 00:47:52 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.