CVE-2026-27072

Vulnerability

Overview The PixelYourSite – Your smart PIXEL (TAG) Manager plugin for WordPress suffers from a stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user input during web page generation. This affects all versions from n/a through 11.2.0.1. [1]

Exploitation

Details Exploitation requires a privileged user (such as an administrator) to perform an action, such as clicking a malicious link or submitting a crafted form. While the attack can be initiated by a lower-privileged role, successful execution depends on the privileged user's interaction. [1]

Impact

An attacker can inject arbitrary scripts, including redirects, advertisements, and other HTML payloads, which will execute when any visitor accesses the affected site. This can lead to website defacement, redirection to malicious sites, or theft of sensitive information. [1]

Mitigation

The vulnerability is patched in version 11.2.0.2. Users are strongly advised to update immediately. Patchstack has also released a mitigation rule to block attacks until the update is applied. [1]