Published October 23, 2026. Based on public CVE records available on that date; details may change.

CVE-2026-109987 is an unauthenticated stored cross-site scripting (XSS) vulnerability in PixelYourSite before 11.4.3 and PixelYourSite Pro before 12.6.8. It matters most on sites that use a full-page cache. Update the free plugin to 11.4.3 or later and the Pro plugin to 12.6.8 or later, then purge every page cache layer so no stored copy keeps serving injected script.

What happened

According to the CVE record, PixelYourSite and PixelYourSite Pro "do not sanitise and escape a cookie value before printing it into the page output." A cookie is a small value the visitor's browser sends with each request, so the visitor controls it completely. If a plugin prints that value into the HTML without escaping it, a crafted cookie can add script to the page.

On its own, that would usually affect only the person who sent the cookie. The record explains why it becomes a stored issue: on a site running a full-page cache, the page built for the attacker's request can be saved by the cache and then served to other visitors. Anyone who loads that cached page, including a logged-in administrator browsing the front end, could run the injected script in their browser.

The record was published by WPScan on October 22, 2026, and credits Jakub Herman as the finder. The PixelYourSite changelog on WordPress.org for 11.4.3 includes the line "Security: Fixed an XSS issue in noscript pixels. Thanks to Jakub Herman via WPScan," which matches that credit.

The CISA ADP entry on the record adds a CVSS 3.1 base score of 7.2 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. That means network attack, low complexity, no privileges, and no user interaction required. The same CISA entry rates exploitation as "none" at the time it was added, and the records reviewed for this article do not mention exploitation in the wild.

Who is affected

Sites running PixelYourSite before 11.4.3 or PixelYourSite Pro before 12.6.8 are affected. The risk described in the record applies when the site also uses a full-page cache, which is common: caching plugins, host-level caches, and CDN page caching all count.

The free plugin is listed on WordPress.org under the slug pixelyoursite, with 400,000+ active installations on WordPress.org as of October 23, 2026. The current WordPress.org release on that date was 11.4.4, which is later than the fix.

PixelYourSite Pro is not distributed through WordPress.org, so its version is not visible there. Check your account on the vendor's site and the Pro changelog to confirm that 12.6.8 or later is available to you, and that your license is active so updates reach the site.

How to check your site

Check the version first. In the WordPress dashboard, open Plugins and find PixelYourSite or PixelYourSite Pro. Compare the version with 11.4.3 for the free plugin and 12.6.8 for Pro.

With WP-CLI, from the WordPress directory:

  • wp plugin list --name=pixelyoursite --fields=name,status,version shows the free plugin's version.
  • wp plugin list --fields=name,status,version lists every plugin, which helps find the Pro plugin under its own directory name.
  • wp plugin update pixelyoursite updates the free plugin from WordPress.org.

Then check whether cached pages contain anything unexpected:

  1. Identify every cache in front of the site: a caching plugin, your host's server cache, and any CDN.
  2. Load a few high-traffic pages in a private browser window and view the page source. Look near the tracking pixel output and any noscript blocks for script or markup your team did not add.
  3. Watch for reports from visitors of redirects, pop-ups, or fake browser prompts. Our guides to the WordPress redirect hack and fake browser update malware describe what that kind of injected script often looks like.

Finding nothing in a few pages does not prove nothing was cached earlier, which is why the purge below matters.

What to do now

Update first, then purge caches. The order matters: purging before the update lets the vulnerable output be cached again.

  1. Update PixelYourSite to 11.4.3 or later, and PixelYourSite Pro to 12.6.8 or later, through Dashboard, Updates, the licensed Pro updater, or WP-CLI.
  2. Purge the full-page cache in your caching plugin. If your host runs its own cache, purge it from the hosting panel. If you use a CDN with page caching, purge it there too.
  3. Recheck a few pages in a private window after the purge.
  4. If an administrator may have viewed an injected page while logged in, review Users for new administrator accounts and review recent changes to plugins, themes, and settings. Our guide to finding hidden WordPress admin users covers accounts that do not appear in the normal list.

If the Pro update is not yet available in your account, contact the vendor and consider disabling the plugin until it is, accepting the temporary loss of tracking.

When to get help

Get help if you found injected script in cached pages, see unexplained admin accounts, or cannot tell how long an affected version was running behind a cache. WordPress malware removal is the right starting point for a suspected compromise, and a security audit can review your plugins, cache layers, and update process.

Sources