WordPress plugin
PixelYourSite – Your smart PIXEL (TAG) & API Manager security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 14 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High3
- Medium11
- Low0
All PixelYourSite – Your smart PIXEL (TAG) & API Manager vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting <12.6.8Update to 12.6.8 | CVE-2026-109987 | |
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting ≤11.4.1Update to 11.4.2 | CVE-2026-95530 | |
| Medium5.3 | Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation <12.6.1Update to 12.6.1 | CVE-2026-18059 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤11.2.0Update to 11.2.0.1 | CVE-2026-1841 | |
| Medium5.3 | Sensitive Information Exposure via Log File ≤11.1.5Update to 11.1.5.1 | CVE-2025-14280 | |
| Medium6.6 | Authenticated (Administrator+) Local File Inclusion <11.1.2Update to 11.1.2 | CVE-2025-10723 | |
| Medium4.3 | PixelYourSite <= 11.1.2 – Cross-Site Request Forgery to GDPR Options Modification ≤11.1.2Update to 11.1.3 | CVE-2025-10588 | |
| High8.1 | Unauthenticated PHP Object Injection 10.1.1.1 – 10.1.1.1Update to 10.1.1.2 | CVE-2025-0769 | |
| Medium4.3 | Cross-Site Request Forgery ≤10.0.1.2Update to 10.0.2 | CVE-2025-22300 | |
| Medium6.5 | Unauthenticated Information Exposure and Log Deletion ≤10.4.2Update to 10.4.3 | CVE-2024-7870 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤9.6.1.1Update to 9.6.2 | CVE-2024-37447 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤9.6.1Update to 9.6.2 | CVE-2023-2584 | |
| Medium4.3 | Cross-Site Request Forgery ≤9.3.0Update to 9.3.1 | CVE-2023-22700 | |
| Medium5.4 | Reflected Cross-Site Scripting <5.3.0Update to 5.3.0 | CVE-2018-0578 |
- High7.2Unauthenticated Stored Cross-Site Scripting
<12.6.8Update to 12.6.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤11.4.1Update to 11.4.2
- Medium5.3Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation
<12.6.1Update to 12.6.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤11.2.0Update to 11.2.0.1
- Medium5.3Sensitive Information Exposure via Log File
≤11.1.5Update to 11.1.5.1
- Medium6.6Authenticated (Administrator+) Local File Inclusion
<11.1.2Update to 11.1.2
- Medium4.3PixelYourSite <= 11.1.2 – Cross-Site Request Forgery to GDPR Options Modification
≤11.1.2Update to 11.1.3
- High8.1Unauthenticated PHP Object Injection
10.1.1.1 – 10.1.1.1Update to 10.1.1.2
- Medium4.3Cross-Site Request Forgery
≤10.0.1.2Update to 10.0.2
- Medium6.5Unauthenticated Information Exposure and Log Deletion
≤10.4.2Update to 10.4.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤9.6.1.1Update to 9.6.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤9.6.1Update to 9.6.2
- Medium4.3Cross-Site Request Forgery
≤9.3.0Update to 9.3.1
- Medium5.4Reflected Cross-Site Scripting
<5.3.0Update to 5.3.0
PixelYourSite – Your smart PIXEL (TAG) & API Manager: common questions
Does PixelYourSite – Your smart PIXEL (TAG) & API Manager have known vulnerabilities?
Yes. VulnCrest Radar lists 14 known vulnerabilities in PixelYourSite – Your smart PIXEL (TAG) & API Manager: 3 high, 11 medium. None are known to affect version null.
How do I check which version of PixelYourSite – Your smart PIXEL (TAG) & API Manager I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent PixelYourSite – Your smart PIXEL (TAG) & API Manager vulnerability?
CVE-2026-109987, published Oct 20, 2026: PixelYourSite (Pro + Free) – Your smart PIXEL (TAG) Manager (plugin) < 11.4.3 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any PixelYourSite – Your smart PIXEL (TAG) & API Manager vulnerability listed in CISA KEV?
No. None of the known PixelYourSite – Your smart PIXEL (TAG) & API Manager vulnerabilities is currently listed in the CISA KEV catalog.