What’s Vulnerable › Vulnerabilities
CVE-2026-13604: Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-01 · updated 2026-08-26
- Weakness: CWE-918
Description
The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows an unauthenticated visitor to inject arbitrary conversion events into the administrator's Facebook ads account and exhaust the configured API quota.
Affected products
- Pixelavo: before 1.5.4 — fixed in 1.5.4
How to fix
Upgrade to a fixed version: Pixelavo 1.5.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-13604 or the next vulnerability affects your stack