PixelYourSite CVE-2026-95530

Requires an authenticated WordPress account at Subscriber level or higher on a site running PixelYourSite <= 11.4.1 (PR:L), and a victim administrator (or other privileged user) must subsequently view the page rendering the injected payload (UI:R) for the script to execute. Exploitation is limited by these two gates: attacker registration must be possible (open registration or obtained credentials) and privileged user interaction is mandatory, so there is no unauthenticated or fully-automated path against a default configuration.

This is a genuine but moderate-priority issue, not an inflated high-CVSS finding. The CVSS 3.1 base of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable but authentication- and interaction-gated stored XSS: an attacker needs a valid low-privilege account and a victim admin must render the injected payload. No EPSS score, KEV listing, POC, or SSVC decision data is provided, so there is no signal of active or automated exploitation - exploitation status is 'no public exploit identified at time of analysis.' The scope change (S:C) inflates the score by crediting cross-context script execution in an admin's browser; the low C/I/A impacts are consistent with reflected/stored script running with a victim's session rather than direct server compromise. I question the A:L rating - an XSS with confidentiality/integrity impact rarely produces genuine availability loss, and a more defensible vector would be A:N (~6.4). Overall: a real defensible bug worth patching on schedule, but not an emergency absent any exploitation evidence.

An attacker registers or obtains a Subscriber-level account on a WordPress site running PixelYourSite <= 11.4.1 and submits a payload containing malicious JavaScript into an input the plugin fails to sanitize. When a site administrator later views that data in wp-admin, the script executes in the admin's authenticated browser session, enabling session/cookie theft, admin-action forgery, or account takeover. No public POC is referenced, and success depends on an administrator viewing the injected content (UI:R).