CVE-2025-10588: PixelYourSite <= 11.1.2 – Cross-Site Request Forgery to GDPR Options Modification
The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 11.1.2. This is due to missing or incorrect nonce validation on the adminEnableGdprAjax() function. This makes it possible for unauthenticated attackers to modify GDPR settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10588?
CVE-2025-10588 is classified as a medium severity vulnerability due to the potential for exploitation via Cross-Site Request Forgery.
How do I fix CVE-2025-10588?
To fix CVE-2025-10588, update the PixelYourSite plugin to version 11.1.3 or later where nonce validation has been implemented.
Which versions of PixelYourSite are affected by CVE-2025-10588?
CVE-2025-10588 affects all versions of the PixelYourSite plugin up to and including version 11.1.2.
What type of vulnerability is CVE-2025-10588?
CVE-2025-10588 is a Cross-Site Request Forgery (CSRF) vulnerability.
What is the impact of exploiting CVE-2025-10588?
Exploiting CVE-2025-10588 could allow an attacker to perform actions on behalf of an authenticated user without their consent.