The PixelYourSite – Your smart PIXEL (TAG) Manager plugin allows stored cross‑site scripting by improperly neutralizing user input during web page generation. This flaw permits an attacker who can add or edit pixel tags to inject malicious JavaScript into the admin interface or the front‑end of a WordPress site. The impact is key‑logging, session hijacking, or other client‑side attacks that threaten confidentiality and integrity, with the potential to affect all users who view the compromised site. The vulnerability is classified as CWE‑79.

WordPress sites that use the PixelYourSite – Your smart PIXEL (TAG) Manager plugin at versions n/a through 11.2.0.1. This includes any site where the plugin is installed and active.

The CVSS score of 7.1 indicates a high potential for damage, while the EPSS score of less than 1% suggests low exploitation probability at this time. The flaw is not listed in the CISA KEV catalog, but the risk is elevated if an attacker can achieve the necessary privileges to create or modify pixel tags. An attacker with sufficient access can leverage the stored XSS to compromise visitors or administrators of the affected WordPress installation.