CVE-2026-1844

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1844", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-03T18:02:12.987Z", "datePublished": "2026-02-13T21:23:04.880Z", "dateUpdated": "2026-04-08T16:35:47.049Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:47.049Z"}, "affected": [{"vendor": "pixelyoursite", "product": "PixelYourSite Pro \u2013 Your smart PIXEL (TAG) Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "12.4.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 12.4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "PixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0fa6a112-ee69-43eb-bded-daba2c2c4dc5?source=cve"}, {"url": "https://www.pixelyoursite.com/plugins/pixelyoursite-professional"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "timeline": [{"time": "2026-02-03T18:06:57.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-13T08:43:25.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T20:34:57.217665Z", "id": "CVE-2026-1844", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T20:35:06.976Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1844", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T20:34:57.217665Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T20:35:02.412Z"}}], "cna": {"title": "PixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "pixelyoursite", "product": "PixelYourSite Pro \u2013 Your smart PIXEL (TAG) Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "12.4.0.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-03T18:06:57.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-13T08:43:25.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0fa6a112-ee69-43eb-bded-daba2c2c4dc5?source=cve"}, {"url": "https://www.pixelyoursite.com/plugins/pixelyoursite-professional"}], "descriptions": [{"lang": "en", "value": "The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 12.4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:47.049Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1844", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:35:47.049Z", "dateReserved": "2026-02-03T18:02:12.987Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-13T21:23:04.880Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PixelYourSite Pro \u2013 Your smart PIXEL (TAG) Manager", "vendor": "pixelyoursite", "versions": [{"lessThanOrEqual": "12.4.0.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 12.4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin PixelYourSite PRO para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro 'pysTrafficSource' y el par\u00e1metro 'pys_landing_page' en todas las versiones hasta la 12.4.0.2, inclusive, debido a una sanitizaci\u00f3n insuficiente de la entrada y un escape de la salida inadecuado. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1844", "lastModified": "2026-06-17T10:16:36.243", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1844", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T20:34:57.217665Z", "version": "2.0.3"}}]}, "published": "2026-02-13T22:16:11.007", "references": [{"source": "security@wordfence.com", "url": "https://www.pixelyoursite.com/plugins/pixelyoursite-professional"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0fa6a112-ee69-43eb-bded-daba2c2c4dc5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,12.4.0.2]"}}], "product": "pixelyoursite_pro_\u2013_your_smart_pixel_(tag)_manager", "vendor": "pixelyoursite"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:43:20.862390+00:00", "value": {"mitigation_remediation": ["Upgrade PixelYourSite PRO to the latest version (12.4.0.3 or newer).", "If an immediate upgrade is not possible, disable or restrict the pysTrafficSource and pys_landing_page fields from accepting user input.", "Implement a Web Application Firewall or strict Content Security Policy to block malicious script injections and mitigate any residual XSS risk."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting accessible without authentication"}, "threat_synthesis": {"affected_systems": "WordPress sites running PixelYourSite PRO version 12.4.0.2 or earlier are affected. The vulnerability exists in all releases up to and including 12.4.0.2 of the PixelYourSite Pro \u2013 Your smart PIXEL (TAG) Manager plugin.", "description_and_impact": "The PixelYourSite PRO plugin for WordPress contains a stored cross\u2011site scripting flaw that allows unauthenticated attackers to inject arbitrary JavaScript through the pysTrafficSource and pys_landing_page parameters. When a victim accesses a page containing the injected payload, the browser executes the script, giving the attacker the ability to hijack sessions, steal data, or deface the site. The weakness originates from insufficient input sanitization and output encoding.", "risk_and_exploitability": "With a CVSS score of 7.2 the flaw represents a high\u2011risk vulnerability, yet the EPSS score is below 1% and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating a low probability of active exploitation at present. Attackers can exploit the flaw by submitting crafted payloads to the plugin\u2019s exposed parameters via standard HTTP requests, with no authentication required. The impact could be far\u2011reaching, affecting all users who visit the compromised pages."}}}}, "created": "2026-02-16T12:03:26.105039+00:00", "updated": "2026-04-15T20:45:06.389486+00:00", "vendors": ["pixelyoursite", "pixelyoursite$PRODUCT$pixelyoursite_pro_\u2013_your_smart_pixel_(tag)_manager", "wordpress", "wordpress$PRODUCT$wordpress"]}