CVE-2026-109987
CVE-2026-109987 · PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.
CVSS 7.2 · High · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
pixelyoursite
- Versions
- ≥ 0, < 11.4.3: Affected (semver)
Update to 11.4.3
pixelyoursite pro
- Versions
- ≥ 0, < 12.6.8: Affected (semver)
Update to 12.6.8