Information disclosure in PixelYourSite – Your smart PIXEL & API Manager
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata — including product names, product IDs, quantities, per-item prices, order totals, currency, and order/transaction IDs — for any existing order by supplying an invalid or arbitrary order key. This is exploitable against any known or enumerated order ID, as the plugin resolves the order from the URL path variable alone and emits the full woo_purchase tracking payload into the page HTML via the pysOptions JavaScript object across its Facebook, Google Analytics, and Google Tag Manager integrations regardless of key validity.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PixelYourSite | PixelYourSite – Your smart PIXEL (TAG) & API Manager | up to 11.2.1 | — | No fix listed | CNA |
| PixelYourSite | PixelYourSite Pro – Your smart PIXEL (TAG) Manager | before 12.6.1 | 12.6.1 | Patch available | CNA |
- PixelYourSite – Your smart PIXEL (TAG) & API Manager VendorPixelYourSite Affected up to 11.2.1 Fixed in — No fix listed CNA
- PixelYourSite Pro – Your smart PIXEL (TAG) Manager VendorPixelYourSite Affected before 12.6.1 Fixed in 12.6.1 Patch available CNA
Remediation
- Fix · CNA PixelYourSite Pro – Your smart PIXEL (TAG) Manager (pixelyoursite) Fixed in 12.6.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-18059
- 2026-10-03 Alias added: GHSA-xf2j-qr39-56f9
References
Other 12
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ca14ec54-0864-47f7-9653-1fe04e2875de?source=cve
- https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.1/modules/facebook/facebook.php#L696
- https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.1/modules/google_analytics/ga.php#L843
- https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.1/modules/google_gtm/gtm.php#L1083
- https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.1/includes/functions-woo.php#L244
- https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.1/includes/class-pys.php#L1112
- https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.0.5/modules/facebook/facebook.php#L696
- https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.0.5/modules/google_analytics/ga.php#L843
- https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.0.5/modules/google_gtm/gtm.php#L1083
- https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.0.5/includes/functions-woo.php#L244
- https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.2.0.5/includes/class-pys.php#L1112
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3629756%40pixelyoursite&new=3629756%40pixelyoursite
More PixelYourSite vulnerabilities
- TI-2023-01697 Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS CVSS 3.1MEDIUM 6.1
- TI-2023-01696 Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS CVSS 3.1MEDIUM 6.1
- TI-2026-06719 Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie CVSS 3.1CRITICAL 9.8
- TI-2026-07922 Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters CVSS 3.1HIGH 7.5
- TI-2024-07294 Improper authentication in PixelYourSite – Your smart PIXEL & API Manager CVSS 3.1HIGH 7.5
- TI-2023-27228 WordPress Product Catalog Feed by PixelYourSite Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
Sources
- CVE-2026-18059 · CVE Program
- CVE-2026-18059 · NVD
- FIRST EPSS
- GHSA-xf2j-qr39-56f9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences