PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation
medium
The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata — including product...
- CVSS:
- 5.3
- Affected:
- up to 12.6.1
- Fixed in:
- 12.6.1
- Disclosed:
- Jul 31, 2026
CVE-2026-18059 on NVD →
PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter
high
The PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 12.5.0.1 via the scan_video. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web applicatio...
- CVSS:
- 7.2
- Affected:
- up to 12.5.0.1
- Fixed in:
- 12.5.0.2
- Disclosed:
- May 1, 2026
CVE-2026-7049 on NVD →
PixelYourSite PRO - Unauthenticated Stored Cross-Site Scripting vulnerability
high
Unauthenticated Stored Cross-Site Scripting vulnerability
- CVSS:
- 7.1
- Affected:
- up to 12.4.0.2
- Fixed in:
- 12.4.0.3
- Disclosed:
- Mar 12, 2026
PixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site Scripting
high
The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 12.4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...
- CVSS:
- 7.2
- Affected:
- up to 12.4.0.2
- Fixed in:
- 12.4.0.3
- Disclosed:
- Feb 13, 2026
CVE-2026-1844 on NVD →
PixelYourSite Professional [pixelyoursite-pro] < 10.4.3
unknown
[en] The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.7.1 and 10.4.2, respectively, through publicly exposed log files. This makes it possible for unauthenticated attackers to...
- Affected:
- up to 10.4.3
- Fixed in:
- 10.4.3
- Disclosed:
- Sep 4, 2024
CVE-2024-7870 on NVD →
PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log Deletion
medium
The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.7.1 and 10.4.2, respectively, through publicly exposed log files. This makes it possible for unauthenticated attackers to view...
- CVSS:
- 6.5
- Affected:
- up to 10.4.2
- Fixed in:
- 10.4.3
- Disclosed:
- Sep 3, 2024
CVE-2024-7870 on NVD →
PixelYourSite Professional [pixelyoursite-pro] < 9.6.2
unknown
[en] The PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.3.6 (9.6.1 in the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissi...
- Affected:
- up to 9.6.2
- Fixed in:
- 9.6.2
- Disclosed:
- Jun 9, 2023
CVE-2023-2584 on NVD →
PixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
medium
The PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.3.6 (9.6.1 in the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions a...
- CVSS:
- 4.4
- Affected:
- up to 9.6.1
- Fixed in:
- 9.6.2
- Disclosed:
- May 16, 2023
CVE-2023-2584 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database