{"id":"CVE-2026-109987","title":"PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie","summary":"The PixelYourSite  WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows una…","severity":"none","cwe":["CWE-79"],"product":"PixelYourSite","affected":["PixelYourSite < 11.4.3","pixelyoursite_pro < 12.6.8"],"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T06:00:17.429Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109987","references":[{"url":"https://wpscan.com/vulnerability/80e1ed6d-dec5-4bfd-851d-3905fd42d23f/"}],"tags":["cve.org"],"ingestedAt":"2026-10-22T06:30:48.514Z","slug":"CVE-2026-109987","body":"## Overview\n\nThe PixelYourSite  WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.\n\n## Affected\n\n- `PixelYourSite < 11.4.3`\n- `pixelyoursite_pro < 12.6.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}