CVE-2023-2584mediumCWE-79

CVE-2023-2584: medium-severity vulnerability in PixelYourSite Pro – Your smart PIXEL (TAG)…

PixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published · Updated

Follow this CVE+ Monitor PixelYourSite – Your smart PIXEL & API Manager+ Monitor PixelYourSite Pro – Your smart PIXEL Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.4epss 0.5%
The PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.3.6 (9.6.1 in the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Affected products
pixelyoursite · PixelYourSite Pro – Your smart PIXEL (TAG) Managerpixelyoursite · PixelYourSite – Your smart PIXEL (TAG) & API Manager
Related CVEs — PixelYourSite Pro – Your smart PIXEL (TAG)…

In the same product, most dangerous first.

CVE-2026-7049HIGHPixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' ParameterEPSS 0.6%CVE-2026-18059MEDIUMPixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key ValidationEPSS 0.6%CVE-2024-7870MEDIUMPixelYourSite – Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log DeletionEPSS 0.4%CVE-2025-14280MEDIUMPixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log FileEPSS 0.4%CVE-2026-1841HIGHPixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-1844HIGHPixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%