What is the CVSS score of CVE-2026-7613?

CVE-2026-7613 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Cost of Goods by PixelYourSite are affected by CVE-2026-7613?

The Cost of Goods by PixelYourSite WordPress plugin (versions ≤1.2.12) contains a stored cross-site scripting vulnerability enabling unauthenticated attackers to inject persistent malicious scripts…

How to fix or mitigate CVE-2026-7613?

Within 24 hours: Conduct inventory of all WordPress installations; identify those running Cost of Goods by PixelYourSite version 1.2.12 or earlier. Within 7 days: Either deactivate and remove the plugin entirely, or deploy WAF rules blocking the 'csvdata[0][cost_of_goods_value]' parameter combined with script tags; enable detailed request logging and SOC alerting for exploitation attempts. Within 30 days: Subscribe to vendor security advisories and prepare upgrade path for alternative cost-tracking plugins; establish rollout plan to deploy patched version immediately upon release.

Cost of Goods by PixelYourSite CVE-2026-7613

EUVD-2026-31126 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-20 Wordfence

GHSA-q8q8-xxpp-gfxq

WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 17:30 vuln.today

DescriptionCVE.org

The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csvdata[0][cost_of_goods_value]' parameter in versions up to, and including, 1.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the Cost of Goods by PixelYourSite WordPress plugin (versions ≤1.2.12) allows remote unauthenticated attackers to inject persistent JavaScript via the 'csvdata[0][cost_of_goods_value]' parameter. Injected payloads execute in the browser of any user (including administrators) who later views the affected page, enabling session hijacking and admin takeover. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is a WordPress plugin distributed by PixelYourSite that integrates with WooCommerce to track product cost-of-goods data, identified by CPE cpe:2.3:a:pixelyoursite:cost_of_goods_by_pixelyoursite. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the plugin accepts CSV-style input through the 'csvdata[0][cost_of_goods_value]' parameter and stores it without sufficient input sanitization, then renders it back to administrative or front-end pages without proper output escaping. Because the malicious content is persisted in the WordPress database, it becomes a stored XSS that fires whenever an authenticated user (typically a store admin reviewing cost data) loads the affected view.

RemediationAI

No vendor-released patched version is identified in the provided data, so the primary action is to consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/6e8646f0-8bd1-4cfd-85bb-86a054ab297f?source=cve and the vendor page at https://www.pixelyoursite.com/plugins/woocommerce-cost-of-goods for any release after 1.2.12 and upgrade immediately when available. Until a fix is published, compensating controls include disabling or fully uninstalling the Cost of Goods by PixelYourSite plugin on production stores (trade-off: loss of cost-of-goods reporting in WooCommerce), restricting access to the plugin's CSV import endpoint via a WAF rule that blocks requests containing the 'csvdata[0][cost_of_goods_value]' parameter with HTML/JavaScript metacharacters (trade-off: may break legitimate CSV uploads containing quoted commas or angle brackets), and enforcing strict Content-Security-Policy headers site-wide to limit the impact of any script execution (trade-off: may break inline scripts used by other plugins or themes).