CVE-2026-109987: PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Sites using PixelYourSite versions before 11.4.3 or PixelYourSite Pro versions before 12.6.8 are affected when they run a full-page cache.
What does an attacker need to exploit it?
An attacker does not need authentication. They need to supply a malicious cookie value that is incorporated into a cached page response.
Who can be impacted after exploitation?
Other visitors who receive the poisoned cached page may execute the stored script in their browsers.
What should be done if the site uses full-page caching?
Upgrade PixelYourSite to 11.4.3 or later, or PixelYourSite Pro to 12.6.8 or later. Clear existing full-page cache contents after upgrading to remove potentially poisoned pages.