Product Catalog Feed by PixelYourSite
Product Catalog Feed by PixelYourSite generates product catalog feeds from WooCommerce products for external shopping and advertising platforms.
Product Catalog Feed by PixelYourSite (product-catalog-feed) is a WordPress plugin with 4 published CVE records in this archive. The latest tracked vulnerability was published Oct 29, 2026; the highest published CVSS base score is 7.2.
product-catalog-feedCVE-2026-118078: Product Catalog Feed by PixelYourSite: PHP object injection
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Untrusted deserialization may create PHP objects; code execution requires a usable gadget chain and its prerequisites, neither of which is established by this record. The structured affected range is n/a through 3.1.4.
| Safe version |
|
||
|---|---|---|---|
| Oct 29, 2026 |
CVE-2026-118078
Product Catalog Feed by PixelYourSite: PHP object injection
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Untrusted deserialization may create PHP objects; code execution requires a usable gadget chain and its prerequisites, neither of which is established by this record. The structured affected range is n/a through 3.1.4.
|
See mitigation notes |
CVE7.2
|
| Dec 17, 2023 |
CVE-2023-49824
Product Catalog Feed by PixelYourSite: Cross-site request forgery
Product Catalog Feed by PixelYourSite is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE5.4
|
| May 02, 2023 |
CVE-2023-1805
Product Catalog Feed by PixelYourSite: Cross-site scripting
Product Catalog Feed by PixelYourSite is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
|
| May 02, 2023 |
CVE-2023-1804
Product Catalog Feed by PixelYourSite: Cross-site scripting
Product Catalog Feed by PixelYourSite is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
|