Meta pixel for WordPress

Meta pixel for WordPress has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 8.0, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2021 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (33%). Other recurring categories include Cross-Site Scripting, Deserialization Of Untrusted Data.

Every one of the 3 issues recorded for Meta pixel for WordPress has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (2) reported by Chloe Chamberland. Meta pixel for WordPress is installed on roughly 400,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh

8.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Meta pixel for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2021-24218

Facebook for WordPress <= 3.0.3 - Cross-site Request Forgery to Stored Cross-site Scripting and Settings Deletion via wp_ajax_(save|delete)_fbe_settings

Read the full analysis

Vulnerability Records

3 records


2026-07-31 00:00	Meta pixel for WordPress <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting Meta pixel for WordPress <= 5.2.1	`CVE-2026-66705`	7.2 High	Rafie Muhammad	Yes
2021-03-25 00:00	Meta pixel for WordPress <= 2.2.2 - PHP Object Injection Meta pixel for WordPress <= 2.2.2	`CVE-2021-24217`	8.1 High	Chloe Chamberland	Yes
2021-03-25 00:00	Facebook for WordPress <= 3.0.3 - Cross-site Request Forgery to Stored Cross-site Scripting and Settings Deletion via wp_ajax_(save\|delete)_fbe_settings Meta pixel for WordPress 3.0.0 – < 3.0.4	`CVE-2021-24218`	8.8 High	Chloe Chamberland	Yes

Showing 1–3 of 3 reports

Plugin Profile

Latestv5.2.2

Meta pixel for WordPress

Author

Facebook

2.7(164)

54/100

Last Updated

2026-07-27 (2mo ago)

Active Installs

400,000+

Downloads

11,293,210

Requires WP

5.7+

Requires PHP

7.4+

Tested up to

WP 7.0.4

Created

2018-11-06 (8y ago)

This plugin will install a Meta Pixel for your page so you can capture the actions people take when they interact with your page, such as Lead, ViewContent, AddToCart, InitiateCheckout and Purchase events. It also includes support for the Conversions API. You’ll be able to see when customers took an action after seeing your ad on Facebook and Instagram, which can help you with retargeting. And when you use the Conversions API alongside the Pixel, it creates a more reliable connection that helps the delivery system decrease your costs. Learn More The Conversions API is designed to create a direct connection between your marketing data and the Meta systems, which help optimise ad targeting, decrease cost per action and measure results across Meta technologies. Learn More You can find more information about our Privacy Policy here.

View on WordPress.org