What is the CVSS score of CVE-2026-27072?

CVE-2026-27072 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of PixelYourSite PixelYourSite are affected by CVE-2026-27072?

A stored cross-site scripting (XSS) vulnerability in PixelYourSite plugin (versions through 11.2.0.1) allows attackers to inject malicious code that persists in your website and executes for all…

How to fix or mitigate CVE-2026-27072?

Within 24 hours: Audit PixelYourSite plugin usage across all WordPress instances and identify all sites running version 11.2.0.1 or earlier. Within 7 days: Implement input validation and output encoding controls at the application layer; deploy WAF rules to detect and block XSS payloads targeting the vulnerable plugin endpoints; consider disabling the plugin if business-critical patches cannot be immediately applied. Within 30 days: Contact vendor for patch availability status; if patch released, deploy to all affected instances after testing; if no patch emerges, evaluate alternative pixel/tag management solutions and migrate accordingly.

PixelYourSite PixelYourSite CVE-2026-27072

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-20 audit@patchstack.com

XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 20, 2026 - 16:22 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite - Your smart PIXEL (TAG) Manager pixelyoursite allows Stored XSS.This issue affects PixelYourSite - Your smart PIXEL (TAG) Manager: from n/a through <= 11.2.0.1.

AnalysisAI

PixelYourSite plugin versions up to 11.2.0.1 contain a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into web pages without authentication. An attacker can exploit this to execute arbitrary JavaScript in the browsers of site visitors, potentially stealing session data or performing unauthorized actions on behalf of users. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager pixelyoursite allows Stored XSS.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through <= 11.2.0.1.

Affected ProductsAI

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.