CVE-2025-10588: fallo de gravedad media en PixelYourSite – Your smart PIXEL (TAG) & API…
PixelYourSite <= 11.1.2 – Cross-Site Request Forgery to GDPR Options Modification
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.2%
The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 11.1.2. This is due to missing or incorrect nonce validation on the adminEnableGdprAjax() function. This makes it possible for unauthenticated attackers to modify GDPR settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Productos afectados
pixelyoursite · PixelYourSite – Your smart PIXEL (TAG) & API ManagerCVEs relacionadas — PixelYourSite – Your smart PIXEL (TAG) & API…
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-18059MEDIUMPixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key ValidationEPSS 0.6%CVE-2023-2584MEDIUMPixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-7870MEDIUMPixelYourSite – Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log DeletionEPSS 0.4%CVE-2025-14280MEDIUMPixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log FileEPSS 0.4%CVE-2026-1841HIGHPixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%