PLUGIN SECURITY
Is Official Facebook Pixel safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Official Facebook Pixel WordPress plugin — checked against WP Clinic's local security database.
Plugin details
- Slug:
official-facebook-pixel - Requires PHP: 7.4+
Known vulnerabilities
- Meta pixel for WordPress [official-facebook-pixel] < 3.0.0 [CVE-2021-24217, Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain, Meta pixel for WordPress <= 2.2.2 - PHP Object Injection]
- Meta pixel for WordPress [official-facebook-pixel] >= 3.0.0 - <= 3.0.3 [CVE-2021-24218, Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion, Facebook for WordPress <= 3.0.3 - Cross-site Request Forgery to Stored Cross-site Scripting and Settings Deletion via wp_ajax_(save|delete)_fbe_settings]
- Meta pixel for WordPress [official-facebook-pixel] < 3.0.0 [WordPress Facebook for WordPress plugin <= 2.2.2 - PHP Object Injection vulnerability]
- Meta pixel for WordPress [official-facebook-pixel] >= 3.0.0 - <= 3.0.3 [WordPress Facebook for WordPress plugin <= 3.0.3 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability]
Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.
Safer / more established alternatives
- Meta for WooCommerce — 400000+ active installs — max PHP 8.4
- Nextend Social Login and Register — 200000+ active installs — max PHP <8.0
- Smash Balloon Social Post Feed – Simple Social Feeds for WordPress — 200000+ active installs — max PHP 8.4
- Metricool – Social media and site statistics — 80000+ active installs
- Facebook Chat Plugin – Live Chat Plugin for WordPress — 80000+ active installs
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.