Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing Security & Risk Analysis

The `woocommerce-google-adwords-conversion-tracking-tag` plugin exhibits a mixed security posture. While static analysis indicates good practices in output escaping (95%) and a significant portion of SQL queries using prepared statements (60%), several concerns are evident. The presence of 7 AJAX handlers, with a concerning 6 lacking proper authentication checks, significantly expands the attack surface and presents a direct risk of unauthorized actions or information disclosure. The plugin also lacks sufficient nonce checks (only 2 for 7 AJAX handlers) which exacerbates the risk posed by unprotected AJAX endpoints.

Historically, the plugin has a concerning track record with 4 known medium-severity vulnerabilities, including Cross-Site Scripting and Exposure of Sensitive Information. While there are currently no unpatched CVEs, the past prevalence of these vulnerability types suggests a recurring weakness in input sanitization and output handling, or reliance on external sources that may introduce risks. The presence of bundled Freemius v1.0, while not explicitly flagged as outdated, is a potential area for future concern if not regularly updated. In conclusion, the plugin has some strengths in code hardening, but the significant number of unprotected AJAX endpoints and the historical vulnerability patterns warrant caution and active monitoring.