Stored Cross-Site Scripting Vulnerability in PixelYourSite Plugin for WordPress
CVE-2026-1841

7.2HIGH

Key Information:

Vendor: WordPress
Status: Pixelyoursite – Your Smart Pixel (tag) & Api Manager
Vendor: CVE Published:; 13 February 2026

What is CVE-2026-1841?

The PixelYourSite plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input validation on the 'pysTrafficSource' and 'pys_landing_page' parameters. This vulnerability allows unauthenticated attackers to inject malicious scripts, leading to arbitrary web content execution whenever a user visits an affected page. This risk is present in all versions up to and including 11.2.0, making it imperative for users to update to the latest version to ensure security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

PixelYourSite – Your smart PIXEL (TAG) & API Manager * <= 11.2.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/pixelyoursite/...

CVSS V3.1

Score:

7.2

Severity:

HIGH

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Changed

Timeline

Vulnerability published
Feb 13, 2026
Vulnerability Reserved
Feb 3, 2026

Credit

Osvaldo Noe Gonzalez Del Rio

JSON

WordPress