The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | PixelYourSite | unaffected |
|
||||||
| Unknown | PixelYourSite Pro | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 22 Oct 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors. | |
| Title | PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-10-22T06:00:17.429Z
Reserved: 2026-10-13T12:27:56.509Z
Link: CVE-2026-109987
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-22T06:17:13.800
Modified: 2026-10-22T06:17:13.800
Link: CVE-2026-109987
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.