{"id":"CVE-2026-109987","kind":"vulnerability","aliases":["CVE-2026-109987"],"related":[],"title":"PixelYourSite WordPress plugins: cookie value stored XSS via full-page cache","description":"The PixelYourSite  WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.","summary":"The PixelYourSite and PixelYourSite Pro WordPress plugins print a cookie value into page output without sanitising or escaping it. On sites with full-page caching, an unauthenticated attacker can get a script stored in the cached page and served to other visitors.","severity":"high","cvss":7.2,"epss":0.00183,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["full-page-cache","package","pixelyoursite","wordpress","wordpress-plugins"],"not_affected_if":["no-full-page-cache","plugin-up-to-date"],"how_to_check":"- Check the installed version of PixelYourSite and PixelYourSite Pro in the WordPress plugins list or `wp plugin list --name=pixelyoursite --fields=name,version` and `wp plugin list --name=pixelyoursite-pro --fields=name,version`\n- Check whether a full-page cache (for example a caching plugin or host-level page cache) is serving pages to anonymous visitors","fix":"- Update PixelYourSite to `11.4.3` or later\n- Update PixelYourSite Pro to `12.6.8` or later\n- Purge the full-page cache after updating so that any previously stored payload is removed","status":"open","published_at":"2026-10-22T06:17:13+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:27:53+00:00","updated_at":"2026-10-25T03:27:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:27:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update PixelYourSite to `11.4.3` or later\n- Update PixelYourSite Pro to `12.6.8` or later\n- Purge the full-page cache after updating so that any previously stored payload is removed","reach":"internet","title":"PixelYourSite WordPress plugins: cookie value stored XSS via full-page cache","impact":"medium","summary":"The PixelYourSite and PixelYourSite Pro WordPress plugins print a cookie value into page output without sanitising or escaping it. On sites with full-page caching, an unauthenticated attacker can get a script stored in the cached page and served to other visitors.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","pixelyoursite","full-page-cache"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker script runs in other visitors' browsers via cached pages","analyst_note":"","how_to_check":"- Check the installed version of PixelYourSite and PixelYourSite Pro in the WordPress plugins list or `wp plugin list --name=pixelyoursite --fields=name,version` and `wp plugin list --name=pixelyoursite-pro --fields=name,version`\n- Check whether a full-page cache (for example a caching plugin or host-level page cache) is serving pages to anonymous visitors","needs_analyst":false,"not_affected_if":["plugin-up-to-date","no-full-page-cache"],"who_is_affected":"Sites running PixelYourSite below `11.4.3` or PixelYourSite Pro below `12.6.8` are exposed. The risk is greatest where a full-page cache stores pages for anonymous visitors, because one poisoned response reaches every later visitor. Sites without a page cache still have the unescaped output but the stored-for-others path depends on caching.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000672,"input_tokens":3400,"output_tokens":663,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109987':15A,18A '-2026':14A,17A '11.4.3':77C '12.6.8':83C 'allow':109C 'attack':57B,111C 'cach':12A,22B,54B,65B,108C,122C 'cooki':4A,38B,90C 'cross':116C 'cross-sit':115C 'cve':13A,16A 'escap':46B,88C 'full':10A,20B,52B,106C 'full-pag':9A,51B,105C 'full-page-cach':19B 'get':59B 'output':42B,98C 'packag':23B 'page':11A,21B,41B,53B,66B,97C,107C,123C 'payload':119C 'pixelyoursit':1A,24B,30B,32B,73C,78C 'plugin':3A,28B,35B,75C,81C 'print':36B,93C 'pro':33B,79C 'run':103C 'sanitis':44B,86C 'script':61B,118C 'serv':68B,127C 'site':49B,102C,117C 'store':6A,62B,113C 'unauthent':56B,110C 'valu':5A,39B,91C 'via':8A 'visitor':71B,130C 'without':43B 'wordpress':2A,25B,27B,34B,74C,80C 'wordpress-plugin':26B 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running PixelYourSite below `11.4.3` or PixelYourSite Pro below `12.6.8` are exposed. The risk is greatest where a full-page cache stores pages for anonymous visitors, because one poisoned response reaches every later visitor. Sites without a page cache still have the unescaped output but the stored-for-others path depends on caching.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T06:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109987","severity":null,"published_at":"2026-10-22T06:17:13+00:00","modified_at":"2026-10-22T15:16:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-109987","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109987","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}