WordPress Plugin Vulnerabilities

PixelYourSite PRO < 12.4.0.3 - Unauthenticated Stored Cross-Site Scripting

Description

The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 12.4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
pixelyoursite-pro
Fixed in 12.4.0.3

References

CVE
CVE-2026-1844
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0fa6a112-ee69-43eb-bded-daba2c2c4dc5

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Osvaldo Noe Gonzalez Del Rio (Os)
Verified
No
WPVDB ID
ef7d1b13-d5ee-4baf-8242-6ccd54449aea

Timeline

Publicly Published
2026-02-13 (about 7 months ago)
Added
2026-02-13 (about 7 months ago)
Last Updated
2026-02-13 (about 7 months ago)

Other

Published
Title
Published
2025-09-22
Title
Login-Logout <= 3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-09-22
Title
Goracash <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-11-18
Title
Youneeq Recommendations <= 3.0.7 - Reflected Cross-Site Scripting
Published
2025-02-18
Title
Subscribe2 – Form, Email Subscribers & Newsletters < 10.44 - Unauthenticated Stored Cross-Site Scripting via IP Parameter
Published
2023-04-19
Title
WP Responsive Tabs horizontal vertical and accordion Tabs < 1.1.16 - Reflected Cross-Site Scripting