# CVE-2026-109987: PixelYourSite WordPress plugin unauthenticated stored XSS in cookie

Source: https://junglewise.ai/threats/cve-2026-109987-the-pixelyoursite-wordpress-plugin-before-11-4-3-pixelyoursite  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-109987 · Severity: info · Published 2026-10-22

PixelYourSite is a WordPress plugin that integrates pixel tracking and analytics. An unauthenticated attacker can inject malicious JavaScript through a cookie that gets stored in the website's cache and served to all visitors, potentially stealing session data or redirecting users to malicious sites. This affects both the free and Pro versions of the plugin.

Vendors: [PixelYourSite](https://junglewise.ai/threats/vendors/pixelyoursite).

## Quick answers

**Is CVE-2026-109987 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109987 being exploited in the wild.

**How severe is CVE-2026-109987?** Informational severity, published 22 October 2026.

**Which products and versions are affected?** PixelYourSite before 11.4.3; PixelYourSite Pro before 12.6.8.

**Is there a fix for CVE-2026-109987?** Yes: fixed in PixelYourSite 11.4.3; PixelYourSite Pro 12.6.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109987 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109987?** Check whether you run PixelYourSite or PixelYourSite Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in PixelYourSite 11.4.3; PixelYourSite Pro 12.6.8

## Technical details

The plugin fails to sanitize and escape a cookie value before outputting it to the page. On sites with full-page caching enabled, an attacker can set a malicious cookie containing JavaScript payload that becomes permanently cached and delivered to all subsequent visitors. This is a stored XSS vulnerability requiring network access but no authentication, with high impact once cached.

## Affected products

- PixelYourSite PixelYourSite before 11.4.3
- PixelYourSite PixelYourSite Pro before 12.6.8

## Timeline

- 2026-10-20: disclosed
- 2026-10-22: advisory

## References

- [https://wpscan.com/vulnerability/80e1ed6d-dec5-4bfd-851d-3905fd42d23f/](https://wpscan.com/vulnerability/80e1ed6d-dec5-4bfd-851d-3905fd42d23f/)