The PixelYourSite PRO plugin for WordPress contains a stored cross‑site scripting flaw that allows unauthenticated attackers to inject arbitrary JavaScript through the pysTrafficSource and pys_landing_page parameters. When a victim accesses a page containing the injected payload, the browser executes the script, giving the attacker the ability to hijack sessions, steal data, or deface the site. The weakness originates from insufficient input sanitization and output encoding.

WordPress sites running PixelYourSite PRO version 12.4.0.2 or earlier are affected. The vulnerability exists in all releases up to and including 12.4.0.2 of the PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin.

With a CVSS score of 7.2 the flaw represents a high‑risk vulnerability, yet the EPSS score is below 1% and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating a low probability of active exploitation at present. Attackers can exploit the flaw by submitting crafted payloads to the plugin’s exposed parameters via standard HTTP requests, with no authentication required. The impact could be far‑reaching, affecting all users who visit the compromised pages.