CVE-2026-109987
PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.
| Vendor | unknown |
| Product | pixelyoursite |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown pixelyoursite
Be the first to know when new unknown vulnerabilities affecting unknown pixelyoursite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / PixelYourSite
0 < 11.4.3
Unknown / PixelYourSite Pro
0 < 12.6.8
References
Credits
Jakub Herman WPScan