TI-2026-79196 Aliases CVE-2026-109987 GHSA-vwmv-9mxc-35hf

Cross-site scripting in PixelYourSite plugins via cookie value

LOW 37CWE-79Published 2026-10-22 · Updated 2026-10-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

The PixelYourSite WordPress plugin before 11.4.3 and PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise or escape a cookie value before printing it into the page output (CWE-79). On a site running a full-page cache, an unauthenticated remote attacker can store a cross-site scripting payload in the cached page, which is then served to other visitors. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00238 14th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed PixelYourSite (Unknown): 11.4.3PixelYourSite Pro (Unknown): 12.6.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	PixelYourSite	before 11.4.3	11.4.3	Patch available	CNA
Unknown	PixelYourSite Pro	before 12.6.8	12.6.8	Patch available	CNA

PixelYourSite VendorUnknown Affected before 11.4.3 Fixed in 11.4.3 Patch available CNA
PixelYourSite Pro VendorUnknown Affected before 12.6.8 Fixed in 12.6.8 Patch available CNA

Remediation

Upgrade PixelYourSite to fixed version 11.4.3 and PixelYourSite Pro to fixed version 12.6.8.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA PixelYourSite (Unknown) Fixed in 11.4.3
Fix · CNA PixelYourSite Pro (Unknown) Fixed in 12.6.8

Timeline

2026-10-22 Threatist record created from CVE-2026-109987
2026-10-22 Alias added: GHSA-vwmv-9mxc-35hf
2026-10-22 CVSS score added · CISA ADP
2026-10-22 Weakness changed · CISA ADP
2026-10-22 CISA SSVC decision points changed

References

Exploit 1

https://wpscan.com/vulnerability/80e1ed6d-dec5-4bfd-851d-3905fd42d23f/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences