PixelYourSite CVE-2026-109987

The target site must be running PixelYourSite (before 11.4.3) or PixelYourSite Pro (before 12.6.8) AND must have a full-page cache active; the description specifies the stored XSS is served to other visitors only because the unsanitised cookie value is captured in the cached page. The exact feature/path that prints the cookie is not detailed in the available sources. Limiting factors: without full-page caching the flaw degrades to self-XSS affecting only the attacker's own session; the payload is delivered via an attacker-controlled cookie value rather than a normal request parameter; and both plugin lines must be at a pre-patch version. No authentication or user interaction is required of the attacker per the CVSS vector (PR:N/UI:N).

This is a stored/persistent Cross-Site Scripting flaw (CWE-79) with a CVSS 3.1 base score of 7.2 and vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, indicating a network-reachable, low-complexity, unauthenticated attack whose scope changes (S:C) because injected script executes in the browsers of other visitors rather than only the vulnerable web application. No EPSS score is provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and there is no indication of active exploitation, so exploitation status is: no public exploit identified at time of analysis - however, a public PoC reference exists (the WPScan advisory), and it is not verified as working exploit code, so POC availability and active exploitation must be treated as distinct and neither is confirmed weaponized. The vuln.today priority Decision label is 'this_week', consistent with a serious-but-not-emergency unauthenticated stored XSS rather than a drop-everything event. The single most important caveat is a configuration dependency stated in the description: exploitation to reach OTHER visitors requires the site to be running a full-page cache, so that the attacker's cookie-derived payload is baked into a cached page and served to everyone. Without full-page caching the cookie value reflects only into the attacker's own session (self-XSS), materially reducing real-world impact. This is therefore a real priority for WordPress sites that both run PixelYourSite/PixelYourSite Pro AND use full-page caching, but a much lower practical risk for sites without page caching.

An unauthenticated attacker sets a crafted cookie containing a JavaScript payload and requests a page on a target site running PixelYourSite with a full-page cache enabled; the plugin prints the cookie value unsanitised into the page HTML, and the cache stores the poisoned page. Subsequent visitors are then served the cached page and the script executes in their browsers (session theft, redirects, admin-targeted actions). A public PoC reference exists via the WPScan advisory, but it is not verified as working exploit code.