Meta pixel for WordPress

Meta pixel for WordPress has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 3 are fixed as of October 2026. Their average CVSS score is 8.0, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2021 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (33%). Other recurring categories include Cross-Site Scripting, Deserialization Of Untrusted Data.

Every one of the 3 issues recorded for Meta pixel for WordPress has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (2) reported by Chloe Chamberland.

Strategic Overview

Avg CVSSHigh

8.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Meta pixel for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2021-24218

Facebook for WordPress <= 3.0.3 - Cross-site Request Forgery to Stored Cross-site Scripting and Settings Deletion via wp_ajax_(save|delete)_fbe_settings

Read the full analysis

Vulnerability Records

3 records


2026-07-31 00:00	Meta pixel for WordPress <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting Meta pixel for WordPress <= 5.2.1	`CVE-2026-66705`	7.2 High	Rafie Muhammad	Yes
2021-03-25 00:00	Meta pixel for WordPress <= 2.2.2 - PHP Object Injection Meta pixel for WordPress <= 2.2.2	`CVE-2021-24217`	8.1 High	Chloe Chamberland	Yes
2021-03-25 00:00	Facebook for WordPress <= 3.0.3 - Cross-site Request Forgery to Stored Cross-site Scripting and Settings Deletion via wp_ajax_(save\|delete)_fbe_settings Meta pixel for WordPress 3.0.0 – < 3.0.4	`CVE-2021-24218`	8.8 High	Chloe Chamberland	Yes

Showing 1–3 of 3 reports