The PixelYourSite WordPress plugin prior to version 11.4.3, and PixelYourSite Pro prior to version 12.6.8, fails to sanitize and escape a cookie value before inserting it into the page output. This omission permits the injection of a Cross‑Site Scripting payload that is persisted in the cached page, allowing an unauthenticated attacker to store malicious code that subsequently executes in the browsers of other site visitors. The flaw is a classic example of stored XSS, identified as CWE‑79, and can lead to theft of user credentials, session hijacking, or the delivery of malware.

WordPress sites that install the free PixelYourSite plugin with a version lower than 11.4.3, or the PixelYourSite Pro plugin with a version lower than 12.6.8. Both variants are affected; the issue is present in any WordPress installation that uses these plugins and runs a full‑page cache.

The vulnerability requires no authentication; an attacker simply needs to set a cookie with a malicious value and force the site to render a page that incorporates that cookie. Because the payload is cached, the malicious code is served to all visitors until the cache expires or is purged. The CVSS score of 7.2 reflects a moderate‑to‑high severity, and the lack of a KEV listing does not reduce the threat, as the flaw remains exploitable on any affected WordPress site utilizing full‑page caching.