CVE-2026-109987
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8…
- Risk score
- 50/100
- CVSS
- 7.2 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page t…
- Affected
- See advisory
- Fix
- Upgrade the product to 11.4.3 or 12.6.8 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.2 high
- Remotely exploitable without logging in
References
Original description
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.
Last activity 22 Oct 2026. Patch Forecast updates every hour.