CVE-2026-7613

Name of the Vulnerable Software and Affected Versions Cost of Goods by PixelYourSite versions prior to 1.2.13

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs via the csvdata[0][cost of goods value] parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by a user.

Recommendations Update Cost of Goods by PixelYourSite to version 1.2.13 or later. Avoid using the csvdata[0][cost of goods value] parameter until the plugin is updated.