Pixelyoursite Your Smart Pixel Tag Manager
Monthly
Authenticated Subscriber-level cross-site scripting in PixelYourSite - Your smart PIXEL (TAG) Manager versions 11.4.1 and earlier allows a user with a WordPress Subscriber account or higher to inject script that executes in the browser of a privileged administrator when the injected content is viewed. Exploitation requires two conditions: the attacker must be able to register or obtain a Subscriber-level account (PR:L per the assessed vector), and a victim administrator must interact with the page rendering the payload (UI:R); there is no unauthenticated or fully automated path against a default configuration. No public exploit identified at time of analysis, and the independent assessment rates this as a genuine but moderate-priority issue rather than an inflated high-CVSS finding.
Authenticated Subscriber-level cross-site scripting in PixelYourSite - Your smart PIXEL (TAG) Manager versions 11.4.1 and earlier allows a user with a WordPress Subscriber account or higher to inject script that executes in the browser of a privileged administrator when the injected content is viewed. Exploitation requires two conditions: the attacker must be able to register or obtain a Subscriber-level account (PR:L per the assessed vector), and a victim administrator must interact with the page rendering the payload (UI:R); there is no unauthenticated or fully automated path against a default configuration. No public exploit identified at time of analysis, and the independent assessment rates this as a genuine but moderate-priority issue rather than an inflated high-CVSS finding.