Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing

1.69.1

Release date – 22.09.2026

• Fix: A post title can no longer break out of the data layer script. WordPress keeps the entities of a closing script tag in a title saved by a Contributor, and the plugin decoded them right before writing the title into its inline script, so the markup after that tag ran on every view of the post. Every inline script now escapes its angle brackets
• Tweak: Every value the plugin prints into a script, an attribute or a link now goes through the escaping function that fits that exact position, so a value that a validation rule stops today stays harmless if that rule ever loosens. None of the corrected sites was exploitable
• Fix: The browser-to-server event endpoint refuses a purchase named inside a pixel’s own object. It only checked the wrapper’s event field, so an unauthenticated request could hand a fabricated purchase with any value straight to a merchant’s Conversions API. Every pixel object is now searched for a purchase event name, and purchases only ever leave through the order hooks
• Fix: A URL that merely carries an order key no longer turns the front page, an archive or a search result into the order confirmation. The plugin printed that order’s customer data into whatever page the key was appended to, and looked the key up however it was shaped. Confirmation pages are also sent with no-cache headers now
• Fix: The public rate limits count the connecting address first. The visitor address comes from proxy headers any client can set, so a rotating header used to hand out a fresh allowance per request and write a database row for each one. A real proxy still gets an allowance per visitor behind it
• Fix: The Google Tag Gateway proxy no longer forwards the visitor’s WordPress login and WooCommerce session cookies to Google’s servers, no longer follows an upstream redirect on the server, and relays only the response headers a browser needs, so a policy header from upstream cannot apply to the shop’s own origin
• Tweak: A settings import now runs every field through the same validator as the settings page, drops keys that are not settings, refuses a schema version the plugin does not know and, on a free tier, keeps the stored values of Pro-only settings. It used to check that a few keys exist and store the file as it was
• Tweak: The products data layer cache is capped at 50 entries per page, an order key must look like one before it is looked up, click IDs from the landing URL are validated like those from cookies, the settings version can no longer be written as if it were a setting, log downloads are limited to the plugin’s own logs, the log redaction masks email addresses, and the Hyros referrer URL is encoded in full

1.69.0

Release date – 21.09.2026

• Fix: A product a shopper adds while the plugin is reading the cart stays in the cart. WooCommerce serves the plugin’s requests with the whole session loaded and writes all of it back at the end, so a request that only reads could still put the older cart back and the added item vanished in front of the shopper. The plugin’s requests now persist nothing, and the one that has to write refreshes the cart first
• Fix: On shops that run iubenda, the visitor’s consent is read at last. iubenda names its cookie after the site ID by default, and the Pixel Manager knew only the older cookie policy ID name, so every category stayed denied and every marketing pixel blocked. It now also reads iubenda’s legacy cookie, and ignores one that states no purposes instead of raising an error
• Fix: An interface whose name carries no Interface_ prefix is now found by the plugin’s autoloader. Three of them, among them the pixel adapter contract every server-side pixel implements, were reachable only because four places required their file by hand, so any other code path that touched them ended in a fatal error
• Fix: A checkout started from the mini cart now carries the cart’s products, value and currency. The plugin left the cart empty while it re-read it from the server, and a checkout click is sent the moment it happens, so the event went out hollow on product and category pages
• Fix: An add to cart or add to wishlist event that reaches the Facebook pixel without product data no longer disappears. The adapter read the missing product and threw, so the event was lost from the browser pixel and the Conversions API alike. Meta needs the product on both events, so a productless one is now skipped cleanly
• Fix: The Diagnostics accuracy trend no longer crashes the admin interface when a custom date is typed rather than picked. A date field reports itself as empty for as long as a typed entry is incomplete, and that empty value reached the report’s date arithmetic while the page was being drawn, so the whole interface dropped to its error screen
• Fix: A blocked Google tag no longer fills the shop’s error tracking with stackless noise. When a content blocker kept the tag from loading, every Google Ads and Google Analytics event raised a promise rejection that carried no message at all, so the recorded entries named neither a cause nor a source. The wait now fails with a reason, and every event handles it
• Fix: The Google Tag Gateway health check can no longer be answered from a cache. It carried no cache headers at all, and a shop was found serving it from its CDN with a 30 day lifetime, so the check reported the gateway healthy by replaying the last time it had been
• Tweak: The Tag Gateway measurement path field now recommends an unguessable path instead of suggesting /metrics. That is Google’s own example, so a great many shops share one predictable path, which is what makes a blocker rule worth writing against all of them at once

1.68.0

Release date – 14.09.2026

• New: The TikTok, Microsoft Ads, Pinterest, Snapchat, Reddit and OpenAI browser pixels are now part of the free plugin, together with Microsoft Ads Consent Mode. The Conversions API and Events API connections, Advanced Matching, Enhanced Match and Enhanced Conversions for these platforms stay in the Pro version
• New: The new pmw_order_shipping_profit filter adds the shipping economics of an order to the profit margin. The calculation leaves shipping out on both sides, because WooCommerce records what the customer was charged but never what the carrier charged the shop, so shops had to rebuild the whole margin to account for it
• New: With the Marketing value logic set to Profit margin, an alert now names how many recent orders contain a product the plugin knows no cost for, and the new Profit_Margin::order_has_complete_cogs() helper answers that for a single order. Such products count with a cost of zero, so their whole revenue is reported as profit
• New: pmw.trackCustomGoogleAdsConversion() sends a conversion to a conversion action of your own, applying the same marketing consent gate and the same wait for the Google tag as the plugin’s own Google Ads conversions. A hand-written gtag() call sent nothing at all on shops that defer or delay JavaScript
• New: The Abilities API now offers every setting the admin interface offers. Ten were missing, among them the lifetime value calculation, the logger and the server-side tracking toggles, so an AI agent was blind to a part of the plugin a shop owner could see
• Tweak: X (Twitter) now counts as a popular pixel on the Tracking Pixels tab, so it shows under the Popular filter and in the popular group of the pixel list
• Tweak: An opportunity card for a Pro feature now says so on installs that cannot use it and carries the upgrade button, and the Payment Gateway Tracking Accuracy alert names server-side tracking and Automatic Conversion Recovery as the fix for the untracked orders it lists. Both only linked to the documentation before
• Tweak: The Consent Management Platforms card no longer reads “None detected on this site” when it finds no cookie banner plugin. It now says that only platforms installed as a WordPress plugin can be listed there, that a platform loaded as a script works on the shop all the same, and how to confirm that in the browser console
• Tweak: With “Always send server-side events” enabled, the Payment Gateway Tracking Accuracy report stops offering that setting as the fix for orders excluded because the visitor denied all consent categories. It now says those conversions were still sent server-side and only stay out of the report because the report measures the browser, and the order records that too
• Tweak: When the accuracy trend compares two periods, it now names how much of the change comes from orders that left the report because the visitor denied all consent categories, and what the change is with those orders counted as untracked in both periods. A shift in that population moves the average accuracy on its own, without a single additional purchase being measured
• Tweak: A script that takes over the plugin’s pmw object now reports itself through the new pmw:warning:global-replaced event and a running count on pmw.globalGuard, not only as a console warning. The shop that reported this could confirm that the errors had stopped but not how often the race still happened, because its analytics tool records errors and not warnings
• Tweak: The extra order data output on order pages is no longer marked as a Pro setting. The plugin allowed it on the free version everywhere except the settings interface, which locked the toggle
• Tweak: The Pinterest events now carry the product brand and category, on the browser pixel and on the Conversions API. Pinterest lists both among the parameters it wants on a checkout and reads their absence as a coverage gap, which holds its automated bidding back
• Tweak: The direct integrations for Borlabs Cookie and Real Cookie Banner have been removed. Direct support for both was deprecated in 1.41.1, and both still reach the plugin through Google Consent Mode update calls, which the plugin reads like any other consent signal
• Tweak: The HTTP request logging setting is no longer marked as a Pro setting. It sits in the otherwise free logger group, and the plugin allowed it on the free version everywhere except the settings interface
• Fix: Under WooCommerce’s built-in Cost of Goods Sold, a variation that inherits or adds to its parent’s cost is priced with that cost at last. The plugin read a meta field that only exists on order line items, so those variations counted with a cost of zero and their whole revenue was reported as profit
• Fix: Pricing an order no longer writes a WooCommerce “doing it wrong” notice into the log for every line item on shops with the built-in Cost of Goods Sold enabled. The cost was read with the generic meta accessor, which WooCommerce answers from the same getter anyway and warns about on the way
• Fix: The lifetime value calculation on orders now asks for an active Pro license everywhere. Its settings field, the route that schedules a recalculation and the calculation itself did not, so it was reachable on the free version and a Pro shop whose license had lapsed kept recalculating its whole order history
• Fix: The trial card on the dashboard no longer claims that no credit card is required. The 14-day trial does ask for a card at checkout, so the card now says so and that cancelling before the trial ends costs nothing
• Fix: A consent tool in auto-blocking mode, such as Cookiebot, could run the plugin’s configuration line again after the tracking library had started, which replaced the library’s object and silently stopped add-to-cart, product click and checkout tracking. The configuration now merges into that object, and the library restores it if another script replaces it
• Fix: A tracking library that stops starting up part way through now reports it in the console, and through the new pmw:error:init-aborted event, instead of leaving the shop partially tracked without a word. The listener files no longer depend on the load order for the functions they use while they register
• Fix: On shops that run CookieYes, the visitor is no longer treated as having answered the cookie banner before they have. CookieYes writes its consent cookie, and fires its consent update event, on the first page view already, in shapes that carry a consent value but no answer, and reading any of those as a choice skipped the region check, so visitors outside the configured Explicit Consent Regions stayed blocked
• Fix: The Cookiebot and OneTrust consent readers now deny a category their cookie does not name instead of granting it. A OneTrust cookie that carries no consent groups, which OneTrust also writes for its own bookkeeping, is ignored rather than raising an error, and one written before the visitor answered the banner no longer counts as a decision
• Fix: On shops that run OneTrust or CookiePro with its standard cookie categories, the visitor’s choice is read at last. The Pixel Manager only understood the plain group numbers, not the C0001 to C0004 ids OneTrust ships by default, so neither the consent cookie nor the consent change event told it anything
• Fix: A gtag('consent', 'update') issued by a cookie banner itself is no longer stored as the Pixel Manager’s own decision. That record has no expiry and outlived the banner that made it, so a decline kept declining after the banner had forgotten it. Such an update can also no longer deny the necessary category
• Fix: On shops that run Complianz, Complianz’ own Google Consent Mode is switched off while the Pixel Manager’s is active, the same as for Cookiebot. Two consent default blocks on one page compete and the last one wins, so the pixels could run against a default consent state the Pixel Manager never set
• Fix: Requests for the Google Tag Gateway service worker that arrive after the measurement path was changed or removed are now answered with a 410 before WordPress runs its query and renders a 404 page. Browsers send one per visit until the old worker is gone, and on a busy shop each one held a PHP worker for seconds
• Fix: One shopper action that the theme, a funnel builder or WooCommerce itself reports twice is now counted once. Each pass carried its own event ID, so a single product view or add to cart reached Pinterest, Meta and GA4 several times, on the browser pixel and on the server-side API alike
• Fix: A Pro setting submitted through the Abilities API on a site without an active Pro license is now refused instead of saved. It was stored with a note that it would not take effect, which left a configuration the plugin could not act on, while the REST API refused the very same value
• Fix: The remove from cart event fires again on the cart and the mini cart. A cart synced from the server replaced the cart item key map that the remove button is resolved through with a different structure, so the event failed with “Wasn’t able to retrieve a productId”, and an item the map does not list now falls back to the product ID on the remove button itself

1.67.0

Release date – 07.09.2026

• New: The new pmw_fire_parent_view_item_on_variable_products filter fires a view_item with the parent product when a variable product page loads. With variations reported separately, no view_item went out at all until the shopper picked a variation, and WooCommerce preselects none by default, so those page views were unreported
• New: The new pmw_facebook_auto_config filter switches Meta’s automatic configuration off per pixel, which stops Meta’s automatic event detection, its microdata scraping and its SmartSetup instrumentation. The snippet our troubleshooting page documented for this defined a placeholder fbq and stopped the Meta pixel from loading at all
• Tweak: The Meta Event Setup Tool warning and the debug report now name every rule and value extractor by its ID and by the URL it is scoped to. Meta sometimes keeps delivering rules after they were deleted in the Events Manager, and only Meta support can remove those, for which they need those IDs
• Tweak: The debug report now has a Google Tag Gateway section that counts gateway requests which ended in a WordPress 404 that day, and names the last one. Nothing in the plugin could show that gateway traffic was being dropped, which is what made the resulting server load so hard to trace
• Tweak: The Pinterest events now use Pinterest’s own standard event names throughout. Product views move from PageVisit to ViewContent, and starting a checkout is reported as InitiateCheckout instead of Checkout. Expect reported Pinterest Checkout conversions to drop, because checkout starts were previously counted as completed orders
• Tweak: The Freemius section of the debug report now states whether the in-dashboard account page exists, why it does not, and which link the plugin hands out in its place. None of that was visible anywhere, so a shop reporting a dead account link could not be diagnosed from a debug report
• Fix: Purchase tracking no longer ends in a fatal error when WooCommerce cannot resolve the order behind an order line item. That broke the checkout response after the payment had already been captured, so those customers read it as a failed payment and ordered again, which charged them twice
• Fix: On LiteSpeed Cache the Pixel Manager excludes itself from “Load JS Deferred: Delayed”, which held every script back until the visitor clicked or scrolled and lost purchases on the order confirmation page. It also keeps its ?ver cache buster when “Remove Query Strings” is on, so browsers stop replaying a pre-update script that requests chunk files no longer shipped
• Fix: The automatic cache purge after a Pixel Manager update now clears NitroPack, Kinsta and Proxy Cache Purge, which failed silently and left those shops serving the previous release’s tracking library, so it disabled itself and tracked nothing. A cache that cannot be cleared now raises an admin notice, and a stale library names itself in the console
• Fix: pmw.trackCustomFacebookEvent() now honors the visitor’s current marketing consent, the same gate every other Meta event passes. It only checked whether the pixel had loaded at some point, so a custom event fired from a shop’s own snippet still reached Meta after the visitor withdrew consent in the cookie banner
• Fix: A jQuery snippet that fires a Pixel Manager event from a pmwLoad handler no longer sends the page into an endless loop that freezes the browser and floods the server with requests, which our own documented parent view_item snippet did. Legacy jQuery handlers on the lifecycle events also ran twice per page load and now run once
• Fix: The deprecated wpmLoad event again reaches listeners that register after the tracking library has loaded. Printing the deprecation warning also switched off the compatibility dispatch, so a snippet registering from _pmwq or from any late-loading script was warned that the event is deprecated and then never called, while identical code running earlier still worked
• Fix: Requests to the Google Tag Gateway service worker, which Google’s tag registers under the measurement path, are answered by the gateway instead of falling through to a full WordPress 404 page. Every visitor triggered one, which flooded 404 logs and put shops with regular traffic under load they had no way to explain
• Fix: The Google Tag Gateway proxy no longer writes several log lines per tracking request at the info level, which grew a normal shop’s daily log to several megabytes and buried the entries the logger was turned on to find. That detail is now logged at the debug level; warnings and errors are unchanged

Earlier versions

For the changelog of earlier versions, please refer to the changelog in the /changelog-archive/ folder of the plugin or the full changelog on https://sweetcode.com/docs/pmw/changelog/free