{"id":"CVE-2026-109987","title":"PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie","summary":"The PixelYourSite  WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows una…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvssSource":"adp","cwe":["CWE-79"],"product":"PixelYourSite","affected":["PixelYourSite < 11.4.3","pixelyoursite_pro < 12.6.8"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-22T10:55:37.426798Z"},"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T11:06:29.603Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109987","references":[{"url":"https://wpscan.com/vulnerability/80e1ed6d-dec5-4bfd-851d-3905fd42d23f/"}],"tags":["cve.org"],"ingestedAt":"2026-10-22T06:30:48.514Z","epss":0.00238,"epssPercentile":0.14794,"slug":"CVE-2026-109987","body":"## Overview\n\nThe PixelYourSite  WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.\n\n## Affected\n\n- `PixelYourSite < 11.4.3`\n- `pixelyoursite_pro < 12.6.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":227600,"id":"CVE-2026-109987","ts":1792669059014,"field":"cvss","old":null,"new":"7.2"},{"seq":227599,"id":"CVE-2026-109987","ts":1792669059014,"field":"severity","old":"none","new":"high"}]}