[ CVE-2026-109987 · Published 22 Oct 2026 ]
Vulnerability in Unknown PixelYourSite
CVSS 7.2
EPSS <1%No fix listed yet
[ Description ]Official description
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.