CVE-2026-1844

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 12.4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
pixelyoursite	PixelYourSite Pro – Your smart PIXEL (TAG) Manager	<= 12.4.0.2

References

Timeline

Published: Feb 13, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-184414.3The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Objec CVE-2026-184427.5The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_u CVE-2026-184438.8The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via th CVE-2026-184447.8There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered in NI LabVIEW. This CVE-2026-184457.8There is an integer overflow vulnerability resulting in an out-of-bounds write recently discovered in NI LabVIEW. This may result in inform CVE-2026-184467.5fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a bac CVE-2026-184478.8Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running CVE-2026-184485.6EDK2 contains a vulnerability in BIOS where a privileged attacker may cause “Exposure of Sensitive Information during Transient Execution” b CVE-2026-184497.5The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that ex CVE-2026-18455.5The Real Estate Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includin CVE-2026-184509.8The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that ex CVE-2026-184513.1The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker