What’s Vulnerable › Vulnerabilities
CVE-2026-109987: PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-22 · updated 2026-10-22
- Weakness: CWE-79
Description
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.
Affected products
- PixelYourSite: before 11.4.3 — fixed in 11.4.3
- PixelYourSite Pro: before 12.6.8 — fixed in 12.6.8
How to fix
Upgrade to a fixed version: PixelYourSite 11.4.3; PixelYourSite Pro 12.6.8. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-109987 or the next vulnerability affects your stack