high7.2
CVE-2026-109987
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it…
Impact
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.
Affected products
| Product | Affected versions |
|---|---|
| PixelYourSite WordPress Plugin | before 11.4.3 |
| PixelYourSite Pro WordPress Plugin | before 12.6.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.