Plugin security history

PixelYourSite – Your smart PIXEL (TAG) & API Manager Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 12 vulnerability records associated with PixelYourSite – Your smart PIXEL (TAG) & API Manager, published between 2018 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

12Total records

0Critical

2High

10Medium

0Low

0Informational

12Patched records

0Currently marked unpatched

2018-04-27First disclosure

2026-07-31Latest disclosure

12 of 12CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2018	1	1 records
2023	2	2 records
2024	2	2 records
2025	5	5 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
High	2	16.7%
Medium	10	83.3%

Vulnerability-Type Breakdown

Cross-Site Scripting

4 records33.3%

First: 2018. Latest: 2026.

CSRF

3 records25%

First: 2023. Latest: 2025.

Other

2 records16.7%

First: 2025. Latest: 2025.

Information Disclosure

2 records16.7%

First: 2025. Latest: 2026.

Authentication Bypass

1 record8.3%

First: 2024. Latest: 2024.

Patch Status

Patched: 12
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

11.2.2
11.2.0.1
11.1.5.1
11.1.2
11.1.3
10.1.1.2
10.0.2
9.7.2
9.6.2
9.3.7
9.3.1
5.3.0

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-11.2.1`	PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation	July 31, 2026	11.2.2	Medium
`*-11.2.0`	PixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site Scripting	February 13, 2026	11.2.0.1	High
`*-11.1.5`	PixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log File	December 29, 2025	11.1.5.1	Medium
`[*, 11.1.2)`	PixelYourSite – Your smart PIXEL (TAG) Manager < 11.1.2 - Authenticated (Administrator+) Local File Inclusion	October 24, 2025	11.1.2	Medium
`*-11.1.2`	PixelYourSite <= 11.1.2 – Cross-Site Request Forgery to GDPR Options Modification	October 21, 2025	11.1.3	Medium
`10.1.1.1`	PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 10.1.1.1 - Unauthenticated PHP Object Injection	February 28, 2025	10.1.1.2	High
`*-10.0.1.2`	PixelYourSite – Your smart PIXEL (TAG) Manager <= 10.0.1.2 - Cross-Site Request Forgery	January 6, 2025	10.0.2	Medium
`*-9.7.1`	PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log Deletion	September 3, 2024	9.7.2	Medium
`*-9.6.1.1`	PixelYourSite – Your smart PIXEL (TAG) Manager <= 9.6.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting	June 28, 2024	9.6.2	Medium
`*-9.3.6`	PixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting	May 16, 2023	9.3.7	Medium
`*-9.3.0`	PixelYourSite <= 9.3.0 - Cross-Site Request Forgery	January 20, 2023	9.3.1	Medium
`[*, 5.3.0)`	PixelYourSite <= 5.2.1 - Reflected Cross-Site Scripting	April 27, 2018	5.3.0	Medium

Selected source records

Latest Records

MediumCVE-2026-18059

PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation

Published: July 31, 2026

Affected versions: [*, 12.6.1)
Patched versions: 12.6.1

Affected versions: *-11.2.1
Patched versions: 11.2.2

Original Wordfence record

HighCVE-2026-1841

PixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site Scripting

Published: February 13, 2026

Affected versions: *-11.2.0
Patched versions: 11.2.0.1

Original Wordfence record

MediumCVE-2025-14280

PixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log File

Published: December 29, 2025

Affected versions: *-11.1.5
Patched versions: 11.1.5.1

Original Wordfence record

MediumCVE-2025-10723

PixelYourSite – Your smart PIXEL (TAG) Manager < 11.1.2 - Authenticated (Administrator+) Local File Inclusion

Published: October 24, 2025

Affected versions: [*, 11.1.2)
Patched versions: 11.1.2

Original Wordfence record

MediumCVE-2025-10588

PixelYourSite <= 11.1.2 – Cross-Site Request Forgery to GDPR Options Modification

Published: October 21, 2025

Affected versions: *-11.1.2
Patched versions: 11.1.3

Original Wordfence record

HighCVE-2025-0769

PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 10.1.1.1 - Unauthenticated PHP Object Injection

Published: February 28, 2025

Affected versions: 10.1.1.1
Patched versions: 10.1.1.2

Original Wordfence record

MediumCVE-2025-22300

PixelYourSite – Your smart PIXEL (TAG) Manager <= 10.0.1.2 - Cross-Site Request Forgery

Published: January 6, 2025

Affected versions: *-10.0.1.2
Patched versions: 10.0.2

Original Wordfence record

MediumCVE-2024-7870

PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log Deletion

Published: September 3, 2024

Affected versions: *-10.4.2
Patched versions: 10.4.3

Affected versions: *-9.7.1
Patched versions: 9.7.2

Original Wordfence record

Highest-Severity Records

HighCVE-2025-0769

PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 10.1.1.1 - Unauthenticated PHP Object Injection

Published: February 28, 2025

Affected versions: 10.1.1.1
Patched versions: 10.1.1.2

Original Wordfence record

HighCVE-2026-1841

PixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site Scripting

Published: February 13, 2026

Affected versions: *-11.2.0
Patched versions: 11.2.0.1

Original Wordfence record

MediumCVE-2025-10723

PixelYourSite – Your smart PIXEL (TAG) Manager < 11.1.2 - Authenticated (Administrator+) Local File Inclusion

Published: October 24, 2025

Affected versions: [*, 11.1.2)
Patched versions: 11.1.2

Original Wordfence record

MediumCVE-2024-7870

PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log Deletion

Published: September 3, 2024

Affected versions: *-10.4.2
Patched versions: 10.4.3

Affected versions: *-9.7.1
Patched versions: 9.7.2

Original Wordfence record

MediumCVE-2018-0578

PixelYourSite <= 5.2.1 - Reflected Cross-Site Scripting

Published: April 27, 2018

Affected versions: [*, 5.3.0)
Patched versions: 5.3.0

Original Wordfence record

MediumCVE-2025-14280

PixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log File

Published: December 29, 2025

Affected versions: *-11.1.5
Patched versions: 11.1.5.1

Original Wordfence record

MediumCVE-2026-18059

PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation

Published: July 31, 2026

Affected versions: [*, 12.6.1)
Patched versions: 12.6.1

Affected versions: *-11.2.1
Patched versions: 11.2.2

Original Wordfence record

MediumCVE-2023-2584

PixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: May 16, 2023

Affected versions: *-9.6.1
Patched versions: 9.6.2

Affected versions: *-9.3.6
Patched versions: 9.3.7

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory