CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2025-22300 – WordPress PixelYourSite plugin <= 10.0.1.2 - Cross Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2025-22300
07 Jan 2025 — Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager allows Cross Site Request Forgery.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through 10.0.1.2. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager permite Cross Site Request Forgery. Este problema afecta a PixelYourSite – Your smart PIXEL (TAG) Manager: desde n/a hasta 10.0.1.2. • https://patchstack.com/database/wordpress/plugin/pixelyoursite/vulnerability/wordpress-pixelyoursite-plugin-10-0-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-7870 – PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log Deletion
https://notcve.org/view.php?id=CVE-2024-7870
03 Sep 2024 — The PixelYourSite – Your smart PIXEL (TAG) & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.7.1 and 10.4.2, respectively, through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, and to delete log files. Los complementos PixelYourSite – Your smart PIXEL (TAG) & API Manager y PixelYourSite PRO pa... • https://github.com/WordpressPluginDirectory/pixelyoursite/blob/main/pixelyoursite/includes/logger/class-pys-logger.php#L126 • CWE-287: Improper Authentication •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37447 – WordPress PixelYourSite plugin <= 9.6.1.1 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-37447
28 Jun 2024 — Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager allows Stored XSS.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through 9.6.1.1. Vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web (XSS o 'Cross-site Scripting') en PixelYourSite PixelYourSite: Your smart PIXEL (TAG) Manager permite XSS almacenado. Este problema afec... • https://patchstack.com/database/vulnerability/pixelyoursite/wordpress-pixelyoursite-your-smart-pixel-tag-api-manager-plugin-9-6-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49824 – WordPress Product Catalog Feed by PixelYourSite Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-49824
05 Dec 2023 — Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite Product Catalog Feed by PixelYourSite.This issue affects Product Catalog Feed by PixelYourSite: from n/a through 2.1.1. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en PixelYourSite Product Catalog Feed by PixelYourSite. Este problema afecta a Product Catalog Feed by PixelYourSite: desde n/a hasta 2.1.1. The Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and incl... • https://patchstack.com/database/vulnerability/product-catalog-feed/wordpress-product-catalog-feed-by-pixelyoursite-plugin-2-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-2584 – PixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2023-2584
16 May 2023 — The PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.3.6 (9.6.1 in the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_ht... • https://plugins.trac.wordpress.org/browser/pixelyoursite/trunk/modules/head_footer/head_footer.php?rev=2773949#L73 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1804 – Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS
https://notcve.org/view.php?id=CVE-2023-1804
10 Apr 2023 — The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators. The Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'edit' parameter in versions up to, and including, 2.1.0 due to insufficient input sanitization and output escapi... • https://wpscan.com/vulnerability/55b28fa6-a54f-4365-9d59-f9e331c1e11b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1805 – Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS
https://notcve.org/view.php?id=CVE-2023-1805
10 Apr 2023 — The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin The Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This m... • https://wpscan.com/vulnerability/46b4582f-7651-4b74-a00b-1788587ecfa8 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22700 – WordPress PixelYourSite – Your smart PIXEL (TAG) Manager Plugin <= 9.3.0 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-22700
20 Jan 2023 — Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 9.3.0 versions. The PixelYourSite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 9.3.0. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such a... • https://patchstack.com/database/vulnerability/pixelyoursite/wordpress-pixelyoursite-your-smart-pixel-tag-manager-plugin-9-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-0578 – PixelYourSite <= 5.2.1 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-0578
27 Apr 2018 — Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de Cross-Site Scripting (XSS) en el plugin PixelYourSite, en versiones anteriores a la 5.3.0 para WordPress, permite que los atacantes remotos inyecten scripts web o HTML arbitrarios utilizando vectores no especificados. The PixelYourSite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in ve... • http://jvn.jp/en/jp/JVN61081552/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •