Is PixelYourSite safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (11.4.4). As of 2026-11-01. 14 issues are on record for older versions; version 11.4.3 or newer fixes all of them that state a fix. Keep PixelYourSite on the latest version (11.4.4) and remove it if you do not use it.

Which versions of PixelYourSite are vulnerable?

Known issues on record (newest first): Cross-site scripting (XSS) (older than 11.4.3, fixed in 11.4.3); Cross-site scripting (XSS) (11.4.1 and older, fixed in 11.4.2); Information disclosure (11.2.1 and older, fixed in 11.2.2); Stored cross-site scripting (XSS) (11.2.0.1 and older, fixed in 11.2.0.2); Stored cross-site scripting (XSS) (11.2.0 and older, fixed in 11.2.0.1); Information disclosure (11.1.5 and older, fixed in 11.1.5.1). The full list with sources is on this page.

What is the latest version of PixelYourSite?

11.4.4, according to wordpress.org (last updated 2026-10-21). It has 400,000+ active installs.

What should I do if my PixelYourSite is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update pixelyoursite). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · pixelyoursite · data as of 2026-11-01

Is PixelYourSite safe? Known vulnerabilities and latest version

Latest version: 11.4.4
Last updated: 2026-10-21
Active installs: 400,000+
Known issues on record: 14
Unpatched in latest: 0
Tested up to WP: 7.1.4 · PHP 5.4+

Add Meta Pixel with Conversion API, Google Analytics (GA4) + Consent Mode, Google Tag Manager, OpenAI Pixel & API, and Head & Footer scripts. — by PixelYourSite

What to do

Update to the latest version (11.4.4). Anything older than 11.4.3 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get pixelyoursite --field=version shows what you run; wp plugin update pixelyoursite updates it.

Check your version

Known vulnerabilities

14 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

high 7.2 CVE-2026-109987 · published 2026-10-22

Cross-site scripting (XSS) in PixelYourSite (older than 11.4.3)

Affected: older than 11.4.3
Fixed in: 11.4.3
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output, which, on a site running a full-page cache, allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.

NVD CVE-2026-109987 WPScan advisory

medium 6.5 CVE-2026-95530 · published 2026-09-23

Cross-site scripting (XSS) in PixelYourSite (11.4.1 and older)

Affected: 11.4.1 and older
Fixed in: 11.4.2
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.

NVD CVE-2026-95530 Patchstack advisory

medium 5.3 CVE-2026-18059 · published 2026-08-01

Information disclosure in PixelYourSite (11.2.1 and older)

Affected: 11.2.1 and older
Fixed in: 11.2.2 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata — including product names, product IDs, quantities, per-item prices, order totals, currency, and order/transaction IDs — for any existing order by supplying an invalid or arbitrary order key. This is exploitable against any known or enumerated order ID, as the plugin resolves the order from the URL path variable alone and emits the full woo_purchase tracking payload into the page HTML via the pysOptions JavaScript object across its Facebook, Google Analytics, and Google Tag Manager integrations regardless of key validity.

NVD CVE-2026-18059 Wordfence advisory Code change (fix)Plugin source

high 7.1 CVE-2026-27072 · published 2026-02-20

Stored cross-site scripting (XSS) in PixelYourSite (11.2.0.1 and older)

Affected: 11.2.0.1 and older
Fixed in: 11.2.0.2
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager pixelyoursite allows Stored XSS.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through <= 11.2.0.1.

NVD CVE-2026-27072 Patchstack advisory

high 7.2 CVE-2026-1841 · published 2026-02-13

Stored cross-site scripting (XSS) in PixelYourSite (11.2.0 and older)

Affected: 11.2.0 and older
Fixed in: 11.2.0.1 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pys_landing_page' parameter in all versions up to, and including, 11.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2026-27072 is likely a duplicate of this issue.

NVD CVE-2026-1841 Wordfence advisory Code change (fix)Plugin source

medium 5.3 CVE-2025-14280 · published 2025-12-29

Information disclosure in PixelYourSite (11.1.5 and older)

Affected: 11.1.5 and older
Fixed in: 11.1.5.1 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The PixelYourSite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.5 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, when the "Meta API logs" setting is enabled (disabled by default). The vulnerability was partially patched in version 11.1.5 and fully patched in version 11.1.5.1.

NVD CVE-2025-14280 Wordfence advisory Code change (fix)Plugin source

low 2.7 CVE-2025-10723 · published 2025-10-24

File inclusion in PixelYourSite (older than 11.1.2)

Affected: older than 11.1.2
Fixed in: 11.1.2
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to function/s, allowing any admins to perform LFI attacks

NVD CVE-2025-10723 WPScan advisory

medium 4.3 CVE-2025-10588 · published 2025-10-22

Cross-site request forgery (CSRF) in PixelYourSite (11.1.2 and older)

Affected: 11.1.2 and older
Fixed in: 11.1.3 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 11.1.2. This is due to missing or incorrect nonce validation on the adminEnableGdprAjax() function. This makes it possible for unauthenticated attackers to modify GDPR settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

NVD CVE-2025-10588 Wordfence advisory Code change (fix)research.cleantalk.org

medium 5.4 CVE-2025-22300 · published 2025-01-07

Cross-site request forgery (CSRF) in PixelYourSite (10.0.1.2 and older)

Affected: 10.0.1.2 and older
Fixed in: 10.0.2
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager pixelyoursite allows Cross Site Request Forgery.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through <= 10.0.1.2.

NVD CVE-2025-22300 Patchstack advisory

high 7.5 CVE-2024-7870 · published 2024-09-04

Information disclosure in PixelYourSite (9.7.1 and older)

Affected: 9.7.1 and older
Fixed in: 9.7.2 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.7.1 and 10.4.2, respectively, through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, and to delete log files.

NVD CVE-2024-7870 Wordfence advisory Code change (fix)github.com Plugin source

medium 4.8 CVE-2024-37447 · published 2024-07-21

Stored cross-site scripting (XSS) in PixelYourSite (9.6.1.1 and older)

Affected: 9.6.1.1 and older
Fixed in: 9.6.2
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager allows Stored XSS.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through 9.6.1.1.

NVD CVE-2024-37447 Patchstack advisory

medium 4.8 CVE-2023-2584 · published 2023-06-09

Stored cross-site scripting (XSS) in PixelYourSite (9.3.6 and older)

Affected: 9.3.6 and older
Fixed in: 9.3.7 *
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.3.6 (9.6.1 in the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

NVD CVE-2023-2584 Wordfence advisory Code change (fix)Plugin source

medium 4.3 CVE-2023-22700 · published 2023-03-13

Cross-site request forgery (CSRF) in PixelYourSite (9.3.0 and older)

Affected: 9.3.0 and older
Fixed in: 9.3.1
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 9.3.0 versions.

NVD CVE-2023-22700 Patchstack advisory

medium 5.4 CVE-2018-0578 · published 2018-05-14

Cross-site scripting (XSS) in PixelYourSite (older than 5.3.0)

Affected: older than 5.3.0
Fixed in: 5.3.0
Access needed (per CVSS): Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
Range from: NVD analysis · score by NVD

Details from the advisory

Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

NVD CVE-2018-0578 wordpress.org jvn.jp

Recent activity

2026-10-21 — latest release on wordpress.org (11.4.4).
2026-10-22 — Cross-site scripting (XSS) disclosed (CVE-2026-109987), fixed in 11.4.3.
2026-09-23 — Cross-site scripting (XSS) disclosed (CVE-2026-95530), fixed in 11.4.2.
2026-08-01 — Information disclosure disclosed (CVE-2026-18059), fixed in 11.2.2.

Free. We check the CVE feeds every day and email you only when a new issue for PixelYourSite (pixelyoursite) is published or a fix ships. Unsubscribe in one click.

Where this data comes from

Version, last update, installs: wordpress.org/plugins/pixelyoursite (Plugins API), fetched 2026-11-01.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-01. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/pixelyoursite"><img src="https://laskyr.com/plugins/pixelyoursite/badge.svg" alt="PixelYourSite vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is PixelYourSite safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (11.4.4)

What to do

Check your version

Known vulnerabilities

Cross-site scripting (XSS) in PixelYourSite (older than 11.4.3)

Cross-site scripting (XSS) in PixelYourSite (11.4.1 and older)

Information disclosure in PixelYourSite (11.2.1 and older)

Stored cross-site scripting (XSS) in PixelYourSite (11.2.0.1 and older)

Stored cross-site scripting (XSS) in PixelYourSite (11.2.0 and older)

Information disclosure in PixelYourSite (11.1.5 and older)

File inclusion in PixelYourSite (older than 11.1.2)

Cross-site request forgery (CSRF) in PixelYourSite (11.1.2 and older)

Cross-site request forgery (CSRF) in PixelYourSite (10.0.1.2 and older)

Information disclosure in PixelYourSite (9.7.1 and older)

Stored cross-site scripting (XSS) in PixelYourSite (9.6.1.1 and older)

Stored cross-site scripting (XSS) in PixelYourSite (9.3.6 and older)

Cross-site request forgery (CSRF) in PixelYourSite (9.3.0 and older)

Cross-site scripting (XSS) in PixelYourSite (older than 5.3.0)

Recent activity

Get an email when PixelYourSite has a new vulnerability

Where this data comes from