PLUGIN SECURITY
Is Pixelyoursite safe?
Add Meta Pixel with Conversion API, Google Analytics (GA4) + Consent Mode, Google Tag Manager, OpenAI Pixel & API, and Head & Footer scripts.
What this plugin does
- Slug:
pixelyoursite - Author: PixelYourSite
- 400000+ active installs
- 86/100 rating (281 reviews on wordpress.org)
- 22004171 all-time downloads
- On WordPress.org since 2015-11-26
google analytics 4google tag managerMeta Conversion APIMeta Pixelopenai
Maintenance status
- Last updated: 2026-11-04 12:08pm GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 5.4+
Known vulnerabilities
13 known CVEs on file for Pixelyoursite.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-109987 | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 11.4.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 11.4.3 | 11.4.3 | 2026-10-22 | — |
| CVE-2026-18059 | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 11.2.2 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 11.2.2 | 11.2.2 | 2026-07-31 | — |
| CVE-2026-95530 | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 11.4.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 11.4.2 | 11.4.2 | 2026-07-31 | — |
| CVE-2026-27072 | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 11.2.0.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 11.2.0.2 | 11.2.0.2 | 2026-02-20 | — |
| CVE-2025-14280 | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 11.1.5.1 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 11.1.5.1 | 11.1.5.1 | 2025-12-29 | — |
| CVE-2025-10723 | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 11.1.2 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Low 2.7 | < 11.1.2 | 11.1.2 | 2025-10-24 | — |
| CVE-2025-10588 | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 11.1.3 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 11.1.3 | 11.1.3 | 2025-10-21 | — |
| CVE-2025-22300 | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 10.0.2 | Cross-Site Request Forgery (CSRF) | Medium 5.4 | < 10.0.2 | 10.0.2 | 2025-01-06 | — |
+ 7 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-7870 | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 9.7.2 | Improper Authentication | High 7.5 | < 9.7.2 | 9.7.2 | 2024-09-03 | — |
| CVE-2024-37447 | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 9.6.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 9.6.2 | 9.6.2 | 2024-06-28 | — |
| CVE-2023-2584 | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 9.3.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 9.3.7 | 9.3.7 | 2023-05-16 | — |
| CVE-2023-22700 | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 9.3.1 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 9.3.1 | 9.3.1 | 2023-01-20 | — |
| CVE-2018-0578 | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 5.3.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 5.3.0 | 5.3.0 | 2018-04-27 | — |
| — | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 10.1.1.2 | Deserialization of Untrusted Data | Unknown | < 10.1.1.2 | 10.1.1.2 | 0000-00-00 | — |
| — | PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite] < 11.2.0.1 | — | Unknown | < 11.2.0.1 | 11.2.0.1 | 0000-00-00 | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- GTM4WP – A Google Tag Manager (GTM) plugin for WordPress — 700000+ active installs — 90/100 (155) — max PHP 8.4
- GTM Kit – Google Tag Manager & GA4 integration — 30000+ active installs — 96/100 (20) — max PHP 8.4
- Beehive Analytics – Google Analytics Dashboard — 20000+ active installs — 90/100 (13) — max PHP <8.0
- Metronet Tag Manager — 20000+ active installs — 96/100 (8)
- Analytify – Dashboard Widget for Google Analytics — 10000+ active installs — 100/100 (4)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.