Live › vulnerability › CVE-2026-109987
Go to dashboardThe PixelYourSite and PixelYourSite Pro WordPress plugins print a cookie value into page output without sanitising or escaping it. On sites with full-page caching, an unauthenticated attacker can get a script stored in the cached page and served to other visitors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running PixelYourSite below or PixelYourSite Pro below are exposed. The risk is greatest where a full-page cache stores pages for anonymous visitors, because one poisoned response reaches every later visitor. Sites without a page cache still have the unescaped output but the stored-for-others path depends on caching.
11.4.312.6.8No product ranges from the sources yet.
wp plugin list --name=pixelyoursite --fields=name,version and wp plugin list --name=pixelyoursite-pro --fields=name,version11.4.3 or later12.6.8 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.
This page as .md · .json · in your agent: get_signal("CVE-2026-109987")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.