---
id: CVE-2026-109987
title: PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie
summary: >-
  The PixelYourSite  WordPress plugin before 11.4.3, PixelYourSite Pro WordPress
  plugin before 12.6.8 do not sanitise and escape a cookie value before printing
  it into the page output, which, on a site running a full-page cache, allows
  una…
severity: none
cwe:
  - CWE-79
product: PixelYourSite
affected:
  - PixelYourSite < 11.4.3
  - pixelyoursite_pro < 12.6.8
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T06:00:17.429Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109987'
references:
  - url: 'https://wpscan.com/vulnerability/80e1ed6d-dec5-4bfd-851d-3905fd42d23f/'
tags:
  - cve.org
ingestedAt: '2026-10-22T06:30:48.514Z'
---

## Overview

The PixelYourSite  WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.

## Affected

- `PixelYourSite < 11.4.3`
- `pixelyoursite_pro < 12.6.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.