Conversios vulnerabilities

Products

• Conversios.io 4
• conversios 3
• google analytics integration for woocommerce 2
• All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce 1
• Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce 1

Latest Conversios CVEs

Newest publication first

1. CVE-2025-62925 WordPress Conversios.io plugin <= 7.2.13 - Broken Access Control vulnerability

   Published 2025-10-27

   Medium·CVSS 5.4 EPSS 0.27%

   Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 7.2.13.

2. CVE-2025-30909 WordPress Conversios.io plugin <= 7.2.3 - Broken Access Control vulnerability

   Published 2025-03-27

   Medium·CVSS 4.3 EPSS 0.33%

   Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 7.2.3.

3. CVE-2023-51357 WordPress Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.0 - Broken Access Control vulnerability

   Published 2024-12-09

   Medium·CVSS 5.3 EPSS 0.50%

   Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 6.5.0.

4. CVE-2024-29794 WordPress Conversios.io plugin <= 6.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2024-03-27

   High·CVSS 7.1 EPSS 0.42%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Conversios Conversios.Io allows Reflected XSS.This issue affects Conversios.Io: from n/a through 6.9.1.

5. CVE-2024-1203 Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce <= 7.0.7 - Authenticated (Subscriber+) SQL Injection

   Published 2024-03-13

   High·CVSS 8.8 EPSS 0.82%

   The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'valueData' parameter in all versions up to, and including, 7.0.7 due to insufficient escaping on the user supplied para...

6. CVE-2023-46094 WordPress Conversios.io Plugin <= 6.5.3 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-10-26

   Medium·CVSS 6.1 EPSS 0.38%

   Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Conversios Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.3 versions.

7. CVE-2022-46797 WordPress Conversios.io Plugin <= 5.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-03-01

   Medium·CVSS 4.3 EPSS 0.23%

   Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <= 5.2.3 leads to plugin settings change.

8. CVE-2021-24952 Conversios.io < 4.6.2 - Subscriber+ SQL Injection

   Published 2022-03-07

   High·CVSS 8.8 EPSS 1.3%

   The Conversios.io WordPress plugin before 4.6.2 does not sanitise, validate and escape the sync_progressive_data parameter for the tvcajax_product_sync_bantch_wise AJAX action before using it in a SQL statement, allowing any authenticated user to perform SQL injection attacks.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.