WordPress Plugin Vulnerabilities

PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie

Description

The plugins do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.

Proof of Concept

Affects Plugins

Plugin icon
pixelyoursite
Fixed in 11.4.3
Plugin icon
pixelyoursite-pro
Fixed in 12.6.8

References

CVE
CVE-2026-109987

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Jakub Herman
Submitter
Jakub Herman
Submitter website
https://jakubherman.net
Verified
Yes
WPVDB ID
80e1ed6d-dec5-4bfd-851d-3905fd42d23f

Timeline

Publicly Published
2026-10-20 (about 23 days ago)
Added
2026-10-20 (about 22 days ago)
Last Updated
2026-11-11 (about 13 hours ago)

Other

Published
Title
Published
2024-11-18
Title
Email Subscription Popup < 1.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via print_email_subscribe_form Shortcode
Published
2021-08-13
Title
jQuery Tagline Rotator <= 0.1.5 - Reflected Cross-Site Scripting
Published
2024-11-25
Title
Jeg Elementor Kit < 2.6.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget
Published
2024-02-15
Title
Widgets Controller <= 1.1 - Unauthenticated Cross-Site Scripting
Published
2025-07-28
Title
StreamWeasels Kick Integration < 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting