PixelYourSite – Your smart PIXEL (TAG) & API Manager

PixelYourSite – Your smart PIXEL (TAG) & API Manager has 12 disclosed vulnerabilities in the WordSec catalog, reported between 2018 and 2026; all 12 are fixed as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 2 high. 2025 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (33%). Other recurring categories include Cross-Site Request Forgery (CSRF), Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 12 issues recorded for PixelYourSite – Your smart PIXEL (TAG) & API Manager has a vendor fix available, so running the current release closes all known holes.

11 independent researchers contributed these findings, most of them (2) reported by Dmitrii Ignatyev. PixelYourSite – Your smart PIXEL (TAG) & API Manager is installed on roughly 500,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891026.11.2015Today27.04.20185.4PixelYourSite <= 5.2.1 - Reflected Cross-Site Scripting CVSS 5.4 · 27.04.201820.01.20234.3PixelYourSite <= 9.3.0 - Cross-Site Request Forgery CVSS 4.3 · 20.01.202316.05.20234.4PixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 16.05.202328.06.20244.4PixelYourSite – Your smart PIXEL (TAG) Manager <= 9.6.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 28.06.202403.09.20246.5PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log Deletion CVSS 6.5 · 03.09.202406.01.20254.3PixelYourSite – Your smart PIXEL (TAG) Manager <= 10.0.1.2 - Cross-Site Request Forgery CVSS 4.3 · 06.01.202528.02.20258.1PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 10.1.1.1 - Unauthenticated PHP Object Injection CVSS 8.1 · 28.02.202521.10.20254.3PixelYourSite <= 11.1.2 – Cross-Site Request Forgery to GDPR Options Modification CVSS 4.3 · 21.10.202524.10.20256.6PixelYourSite – Your smart PIXEL (TAG) Manager < 11.1.2 - Authenticated (Administrator+) Local File Inclusion CVSS 6.6 · 24.10.202529.12.20255.3PixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log File CVSS 5.3 · 29.12.202513.02.20267.2PixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 13.02.202631.07.20265.3PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation CVSS 5.3 · 31.07.2026

Strategic Overview

Avg CVSSMedium
5.5/ 10
Patch Coverage100%
Open

0

Fixed

12

Get automatic notifications for all PixelYourSite – Your smart PIXEL (TAG) & API Manager vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2025-0769

PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 10.1.1.1 - Unauthenticated PHP Object Injection

Read the full analysis

Vulnerability Records

12 records
2026-07-31 19:45CVE-2026-18059
5.3
Medium
Win3Yes
2026-02-13 08:43CVE-2026-1841
7.2
High
Osvaldo Noe Gonzalez Del Rio (Os)Yes
2025-12-29 05:47CVE-2025-14280
5.3
Medium
Marcin Dudek (dudekmar)Yes
2025-10-24 00:00CVE-2025-10723
6.6
Medium
Dmitrii IgnatyevYes
2025-10-21 17:47CVE-2025-10588
4.3
Medium
Dmitrii IgnatyevYes
2025-02-28 00:00CVE-2025-0769
8.1
High
Andres RoldanYes
2025-01-06 00:00CVE-2025-22300
4.3
Medium
Dhabaleshwar DasYes
2024-09-03 00:00CVE-2024-7870
6.5
Medium
XetnusYes
2024-06-28 00:00CVE-2024-37447
4.4
Medium
ngductungYes
2023-05-16 00:00CVE-2023-2584
4.4
Medium
Marco WotschkaYes
Showing 1–10 of 12 reports
PixelYourSite – Your smart PIXEL (TAG) & API Manager banner
Latestv11.4.1

PixelYourSite – Your smart PIXEL (TAG) & API Manager

PixelYourSite

Author

PixelYourSite

4.3(274)
86/100
Last Updated
2026-09-11 (2d ago)
Active Installs
500,000+
Downloads
20,993,180
Requires WP
4.4+
Requires PHP
5.4+
Tested up to
WP 7.1
Created
2015-11-26 (11y ago)

Trusted by 500,000+ websites, PixelYourSite is a complete tracking solution for the Meta Pixel, Google Analytics 4, Google Tag Manager, and now OpenAI and ChatGPT traffic too. Set up Meta Pixel with full Conversion API support, Google Analytics 4, and Google Tag Manager on your WordPress site, no coding required. Need to add a custom script somewhere? Our Head & Footer option handles that too. Pinterest, Bing, and Reddit tracking are available as dedicated paid add-ons: Pinterest Tag, Bing Tag, Reddit Pixel. NEW: OpenAI Pixel & API. Install the OpenAI Pixel, enable the API, configure conversions, and start tracking ChatGPT referred traffic in minutes. Watch the setup video. NEW: Talk to your tracking setup. Connect Claude, or any other MCP compatible AI assistant, and it can audit your pixels, check your Meta EMQ score, and fix configuration issues for you. No need to dig through settings screens yourself. Watch how to connect Claude, or watch a fast WooCommerce audit. Free training: Our YouTube channel covers the plugin, Meta API, Google Analytics, Google Ads, TikTok, and more. Start with this one on how to check and fix your Meta catalog match rate, crucial for WooCommerce ads: What you can do with the free version: Install the Meta Pixel with Conversion API support, so your ad data survives ad blockers and iOS tracking limits. Install Google Analytics 4 (GA4). Install Google Tag Manager and push events into the data layer with zero coding. Configure Google Consent Mode: see the full guide. Set up Google Tag Manager server side tagging for our native GA4 script: see the full guide. Install the OpenAI Pixel & API. Add any other script with our Head & Footer option. Connect Claude or another MCP compatible AI assistant to audit and manage your tracking setup. Built for WooCommerce: All e-commerce specific events fire automatically, no manual event mapping needed. Every parameter required for dynamic ads (Meta or Google) is included out of the box. Choose how products are identified: default IDs, SKU, or Facebook for WooCommerce’s own product ID logic, so your catalog and your tracking always match. Customer data is used to improve your Meta EMQ score on API events. Built for Easy Digital Downloads: All e-commerce specific events fire automatically. Every parameter needed for dynamic ads (Meta or Google) is included out of the box, same as WooCommerce. Customer data is used to improve your Meta EMQ score on API events. Automated events, tracked without any setup: Searches (with the search term captured as a parameter). Form submissions. User signups and logins. Downloads (file name and type captured as parameters). Comments. Page scroll depth. Time on page. Need something more specific? Configure any standard or custom event for Meta, GA4, or GTM yourself. Head & Footer scripts, placed exactly where you need them: Site wide, or on specific pages only. On the WooCommerce order received page. Desktop only, mobile only, or both. Consent & GDPR, handled properly: Works with the most popular consent management plugins out of the box. Consent filters let other consent plugins control our scripts and cookies directly. Fires GA4 tags with Google Consent Mode granted. A dedicated filter enables Meta Limited Data Use. Fully integrated with ConsentMagic. Google Tag Manager, without the manual setup: Most tracking plugins make you build GTM triggers and variables by hand. PixelYourSite pushes every event straight into the GTM data layer, and our GTM Container Import file pre-configures triggers, variables, and Google Analytics 4 tags for you: see how it works. When you need more than the free version covers: PixelYourSite Professional and our other plugins (WooCommerce Feed Plugin, ConsentMagic) add: Google Ads and TikTok tags. Pinterest and Bing tags, via paid add-ons. More automated events and more parameters, including landing page, traffic source, and UTM tracking. More triggers for custom events: link clicks, CSS selectors, page view counts, mouse over, video views, email link clicks, post type, and direct integration with popular form plugins and Elementor forms. Deeper EMQ improvements, including pulling user data from forms and URLs. More complete WooCommerce and EDD purchase tracking. Support for multiple tags per platform, with conditional rules for where each one fires. Native WooCommerce and EDD reporting. A quick, honest note: this free plugin stays free and fully supported because people upgrade to Pro. Every update, every fix, and every new feature here, including OpenAI Pixel & API, gets built and maintained using Pro revenue. If the free version is useful to you, buying Pro is what keeps it that way. Further reading: Guides for getting more out of your tracking setup, on the free version and on Pro: Improve your Meta EMQ Score Track WordPress Forms Automated Events, explained Set up GTM server side tagging Handle Google Consent Mode V2 Build custom tracking events by chatting with Claude or ChatGPT Audit your WooCommerce tracking with Claude or ChatGPT Track phone calls from Google Ads as conversions A few more videos worth watching: Yes, it’s fine if Meta sees the same event more than once How much profit is your WooCommerce store really making from Meta ads Documentation: Full documentation for PixelYourSite and all our plugins

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C