---
id: "CVE-2026-118078"
kind: "vulnerability"
aliases: ["CVE-2026-118078"]
title: "PixelYourSite Product Catalog Feed: PHP object injection by shop managers"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Product Catalog Feed by PixelYourSite", "fixed": [], "affected": "<= 3.1.4", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "php-object-injection", "pixelyoursite", "shop-manager", "woocommerce", "wordpress"]
not_affected_if: ["no-shop-manager-accounts", "plugin-not-installed", "plugin-updated"]
published_at: "2026-10-29T16:18:02+00:00"
first_seen_at: "2026-10-29T16:25:57+00:00"
updated_at: "2026-10-29T16:38:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118078", "first_seen_at": "2026-10-29T16:25:57+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T16:38:28+00:00"}]
---

# PixelYourSite Product Catalog Feed: PHP object injection by shop managers

The PixelYourSite Product Catalog Feed WordPress plugin, versions 3.1.4 and earlier, has a PHP object injection flaw. A shop manager account can abuse it to inject serialized PHP objects, which can lead to code execution depending on the site's available classes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:Product Catalog Feed by PixelYourSite affected <= 3.1.4 fixed ?

## How to check

- In WordPress admin > Plugins, find 'Product Catalog Feed by PixelYourSite' and read its version; 3.1.4 or earlier is listed as affected by Patchstack/NVD.
- Or run: wp plugin list --name=product-catalog-feed --fields=name,version,status
- Note: version numbers may not line up with the vendor's 5.x changelog; if unsure, ask the vendor.

## Timeline

- 2026-10-29T16:25:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118078
- 2026-10-29T16:38:28+00:00 analyst — NVD/Patchstack (CNA): CWE-502, <=3.1.4, shop manager (PR:H) required, CVSS 7.2. Patchstack says no official patch; vendor changelog (Pro line is at 5.9.4) mentions no security fix, so fix is unknown. Version numbering is odd: wp.org free plugin is 2.2.0 and Pro is 5.x, so '3.1.4' does not map clearly to either; ask Patchstack/vendor. Gadget chain: not stated, RCE depends on classes present (WooCommerce/other plugins). Not exploited, no PoC found. Nothing verified (no vendor statement).

## Documents

- [advisory] Patchstack: Product Catalog Feed by PixelYourSite <= 3.1.4 PHP Object Injection https://patchstack.com/database/wordpress/plugin/product-catalog-feed/vulnerability/wordpress-product-catalog-feed-by-pixelyoursite-plugin-3-1-4-php-object-injection-vulnerability
- [describes] PixelYourSite: Product Catalog Feed for WooCommerce change log https://www.pixelyoursite.com/product-catalog-feeds-for-woocommerce-logs
- [mentions] wordpress.org: Product Catalog Feed by PixelYourSite (v2.2.0, 2023) https://wordpress.org/plugins/product-catalog-feed/

## From the sources

Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_