PT-2026-121268

CVE-2026-109987

Published

2026-10-22

Updated

2026-10-22

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PixelYourSite versions prior to 11.4.3 PixelYourSite Pro versions prior to 12.6.8

Description Insufficient sanitization and escaping of a cookie value before it is printed into the page output allows unauthenticated attackers to perform stored Cross-Site Scripting (XSS) on sites utilizing a full-page cache. This enables the injection of malicious scripts into the cached page, which are subsequently served to other visitors.

Recommendations Update PixelYourSite to version 11.4.3 or later. Update PixelYourSite Pro to version 12.6.8 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jakub Herman

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers