CVE-2026-1841

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1841", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-03T16:57:17.381Z", "datePublished": "2026-02-13T21:23:05.247Z", "dateUpdated": "2026-04-08T16:51:13.845Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:13.845Z"}, "affected": [{"vendor": "pixelyoursite", "product": "PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "11.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 11.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2026-27072 is likely a duplicate of this issue."}], "title": "PixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4c4f2d9d-d34c-45dd-aff8-ca9bbe808b5a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.5.2/includes/enrich/class_enrich_order.php#L255"}, {"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.5.2/includes/enrich/class_enrich_order.php#L266"}, {"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.5.2/includes/enrich/class_enrich_order.php#L252"}, {"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.5.2/includes/enrich/class_enrich_order.php#L265"}, {"url": "https://plugins.trac.wordpress.org/changeset/3454364/pixelyoursite"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "timeline": [{"time": "2026-02-03T17:13:08.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-13T08:43:23.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T20:35:49.813009Z", "id": "CVE-2026-1841", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T20:36:30.660Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1841", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T20:35:49.813009Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T20:36:24.091Z"}}], "cna": {"title": "PixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "pixelyoursite", "product": "PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "11.2.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-03T17:13:08.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-13T08:43:23.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4c4f2d9d-d34c-45dd-aff8-ca9bbe808b5a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.5.2/includes/enrich/class_enrich_order.php#L255"}, {"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.5.2/includes/enrich/class_enrich_order.php#L266"}, {"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.5.2/includes/enrich/class_enrich_order.php#L252"}, {"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.5.2/includes/enrich/class_enrich_order.php#L265"}, {"url": "https://plugins.trac.wordpress.org/changeset/3454364/pixelyoursite"}], "descriptions": [{"lang": "en", "value": "The PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 11.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2026-27072 is likely a duplicate of this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:13.845Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1841", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:51:13.845Z", "dateReserved": "2026-02-03T16:57:17.381Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-13T21:23:05.247Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager", "vendor": "pixelyoursite", "versions": [{"lessThanOrEqual": "11.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 11.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2026-27072 is likely a duplicate of this issue."}, {"lang": "es", "value": "El plugin PixelYourSite \u2013 Your smart PIXEL (TAG) &amp; API Manager para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'pysTrafficSource' y el par\u00e1metro 'pys_landing_page' en todas las versiones hasta la 11.2.0, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1841", "lastModified": "2026-06-17T10:16:35.937", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1841", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T20:35:49.813009Z", "version": "2.0.3"}}]}, "published": "2026-02-13T22:16:10.833", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.5.2/includes/enrich/class_enrich_order.php#L252"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.5.2/includes/enrich/class_enrich_order.php#L255"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.5.2/includes/enrich/class_enrich_order.php#L265"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.5.2/includes/enrich/class_enrich_order.php#L266"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3454364/pixelyoursite"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4c4f2d9d-d34c-45dd-aff8-ca9bbe808b5a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,11.2.0]"}}], "product": "pixelyoursite_\u2013_your_smart_pixel_(tag)_&_api_manager", "vendor": "pixelyoursite"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:42:55.570252+00:00", "value": {"mitigation_remediation": ["Upgrade to a patched version of PixelYourSite that addresses the stored XSS vulnerability.", "Clean any existing order enrichment entries that may contain script tags in pysTrafficSource or pys_landing_page using the plugin\u2019s settings or direct database queries.", "Deploy a Content\u2011Security\u2011Policy header that restricts script sources to trusted domains to mitigate the impact of any remaining XSS payloads.", "If an update cannot be applied immediately, manually enforce output escaping on the affected fields before rendering them in templates."], "summary": {"action": "Patch Now", "impact": "Client\u2011Side Code Execution via Stored XSS"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed the PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager plugin version 11.2.0 or older. The vulnerability applies across all installations of that plugin, regardless of other configuration.", "description_and_impact": "The PixelYourSite plugin for WordPress contains a stored cross\u2011site scripting flaw that allows attackers to embed arbitrary scripts in website pages. The flaw resides in the pysTrafficSource and pys_landing_page parameters and results from missing input sanitisation and output escaping. When a victim user visits a page that includes the attacker\u2011controlled data, the injected script runs in the user\u2019s browser, potentially compromising session data, defacing content or redirecting the user to malicious sites.", "risk_and_exploitability": "The flaw carries a CVSS score of 7.2 and an EPSS probability of less than 1\u202f%. It is not listed in the CISA KEV catalog, but its unauthenticated nature and stored\u2011payload characteristic make it attractive to attackers. Exploitation requires only that an attacker submit a malicious payload via the vulnerable parameters, which will then be stored and executed for any user who views the affected page. No elevated privileges or additional malware delivery is necessary."}}}}, "created": "2026-02-16T12:03:25.330983+00:00", "updated": "2026-04-15T20:45:06.388873+00:00", "vendors": ["pixelyoursite", "pixelyoursite$PRODUCT$pixelyoursite_\u2013_your_smart_pixel_(tag)_&_api_manager", "wordpress", "wordpress$PRODUCT$wordpress"]}