Live › vulnerability › CVE-2026-118078
The PixelYourSite Product Catalog Feed WordPress plugin, versions 3.1.4 and earlier, has a PHP object injection flaw. A shop manager account can abuse it to inject serialized PHP objects, which can lead to code execution depending on the site's available classes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
WordPress/WooCommerce sites running the Product Catalog Feed by PixelYourSite plugin (slug product-catalog-feed) at 3.1.4 or earlier. Exploitation needs a logged-in Shop Manager (or higher) account, so risk is mainly stores with several staff, agencies or a compromised manager account. Impact depends on gadget classes from other installed plugins. Sites without the plugin can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Product Catalog Feed by PixelYourSite | wordpress | <= 3.1.4 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-118078")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.