Cost of Goods by PixelYourSite EUVD-2026-31126

The Cost of Goods by PixelYourSite plugin (version ≤1.2.12) must be installed and active on a WordPress site, and the endpoint that processes the 'csvdata[0][cost_of_goods_value]' parameter must be reachable by the attacker (CVSS AV:N/PR:N/UI:N confirms network-reachable and no authentication required to inject). The principal LIMITING factor is that full impact (admin compromise via S:C) only materializes when a privileged user subsequently views the page containing the injected payload - so a WordPress site that has the plugin installed but where no admin ever loads the affected view would see no realized impact. Confidentiality and integrity impact are rated Low (C:L/I:L), reflecting the typical scope of browser-side script execution rather than direct server compromise.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N gives a 7.2 (High) score driven primarily by the changed scope (S:C) - XSS executing in another user's browser context - combined with no authentication or user-interaction requirement to PLANT the payload. However, real-world impact still depends on a privileged user later loading the injected page, which the CVSS UI:N covers for the injection step but not the trigger step; this is a common nuance for stored-XSS scoring. No EPSS, KEV, or SSVC data was provided, and no public POC reference appears in the inputs, so this should be triaged as a credible but not actively-exploited issue: high enough to patch promptly on any site running this plugin (especially WooCommerce stores) because admin-session theft would lead directly to full site compromise, but not an emergency 'drop everything' item compared to KEV-listed flaws.

An unauthenticated attacker submits a crafted request to the plugin's CSV import handler containing a JavaScript payload in the 'csvdata[0][cost_of_goods_value]' parameter, which is stored in the WordPress database without sanitization. When a store administrator later opens the cost-of-goods view in wp-admin, the payload executes in their authenticated session, allowing the attacker to steal admin cookies, create new administrator accounts, or pivot to full WordPress site compromise. No public exploit identified at time of analysis, but the attack pattern is well-known and trivial to script.