The PixelYourSite plugin for WordPress contains a stored cross‑site scripting flaw that allows attackers to embed arbitrary scripts in website pages. The flaw resides in the pysTrafficSource and pys_landing_page parameters and results from missing input sanitisation and output escaping. When a victim user visits a page that includes the attacker‑controlled data, the injected script runs in the user’s browser, potentially compromising session data, defacing content or redirecting the user to malicious sites.

WordPress sites that have installed the PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin version 11.2.0 or older. The vulnerability applies across all installations of that plugin, regardless of other configuration.

The flaw carries a CVSS score of 7.2 and an EPSS probability of less than 1 %. It is not listed in the CISA KEV catalog, but its unauthenticated nature and stored‑payload characteristic make it attractive to attackers. Exploitation requires only that an attacker submit a malicious payload via the vulnerable parameters, which will then be stored and executed for any user who views the affected page. No elevated privileges or additional malware delivery is necessary.