Stored Cross-Site Scripting Vulnerability in PixelYourSite PRO Plugin for WordPress
CVE-2026-1844

7.2HIGH

Key Information:

Vendor

WordPress
Status
Pixelyoursite Pro – Your Smart Pixel (tag) Manager
Vendor
CVE Published:
13 February 2026

What is CVE-2026-1844?

The PixelYourSite PRO plugin for WordPress is susceptible to Stored Cross-Site Scripting due to improper input validation and insufficient output escaping in the 'pysTrafficSource' and 'pys_landing_page' parameters. This vulnerability allows attackers, even those who are unauthenticated, to inject malicious scripts into web pages, resulting in potential arbitrary execution of the injected scripts when users visit the affected pages. It highlights the importance of robust input sanitization and output handling to protect users from such risks.

Affected Version(s)

PixelYourSite Pro – Your smart PIXEL (TAG) Manager 0 <= 12.4.0.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.pixelyoursite.com/plugins/pixelyoursite-profe...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Osvaldo Noe Gonzalez Del Rio
.