CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109987
HIGHCVSS 7.2NVD feed
Published 22 October 2026 · tracked since 23 October 2026
Description
The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog