Unauthenticated Stored Cross-Site Scripting in PixelYourSite Order Enrichment

PixelYourSite up to 11.2.0 stores the pys_landing_page and pysTrafficSource cookie values in WooCommerce and Easy Digital Downloads order data without sanitization, and prints them unescaped on the admin order screen and in the New Order email. An unauthenticated visitor can set these cookies before checking out and inject JavaScript that runs when a shop administrator views the order.

This vulnerability affects the following application versions:

• PixelYourSite – Your smart PIXEL 9.5.0
• PixelYourSite – Your smart PIXEL 9.5.0.1
• PixelYourSite – Your smart PIXEL 9.5.1
• PixelYourSite – Your smart PIXEL 9.5.1.1
• PixelYourSite – Your smart PIXEL 9.5.3
• PixelYourSite – Your smart PIXEL 9.5.4
• PixelYourSite – Your smart PIXEL 9.5.5
• PixelYourSite – Your smart PIXEL 9.6.0
• PixelYourSite – Your smart PIXEL 9.6.0.1
• PixelYourSite – Your smart PIXEL 9.6.1
• PixelYourSite – Your smart PIXEL 9.6.1.1
• PixelYourSite – Your smart PIXEL 9.6.2
• PixelYourSite – Your smart PIXEL 9.7.0
• PixelYourSite – Your smart PIXEL 9.7.0.1
• PixelYourSite – Your smart PIXEL 9.7.1
• PixelYourSite – Your smart PIXEL 9.7.2
• PixelYourSite – Your smart PIXEL 10.0.0
• PixelYourSite – Your smart PIXEL 10.0.1
• PixelYourSite – Your smart PIXEL 10.0.1.1
• PixelYourSite – Your smart PIXEL 10.0.1.2
• PixelYourSite – Your smart PIXEL 10.0.2
• PixelYourSite – Your smart PIXEL 10.0.3
• PixelYourSite – Your smart PIXEL 10.0.3.1
• PixelYourSite – Your smart PIXEL 10.0.4
• PixelYourSite – Your smart PIXEL 10.1.0
• PixelYourSite – Your smart PIXEL 10.1.1
• PixelYourSite – Your smart PIXEL 10.1.1.1
• PixelYourSite – Your smart PIXEL 10.1.1.2
• PixelYourSite – Your smart PIXEL 10.1.2.1
• PixelYourSite – Your smart PIXEL 10.1.3
• PixelYourSite – Your smart PIXEL 10.2.0
• PixelYourSite – Your smart PIXEL 10.2.0.1
• PixelYourSite – Your smart PIXEL 10.2.0.2
• PixelYourSite – Your smart PIXEL 10.2.1
• PixelYourSite – Your smart PIXEL 11.0.0
• PixelYourSite – Your smart PIXEL 11.0.0.1
• PixelYourSite – Your smart PIXEL 11.0.0.2
• PixelYourSite – Your smart PIXEL 11.0.0.3
• PixelYourSite – Your smart PIXEL 11.0.0.4
• PixelYourSite – Your smart PIXEL 11.0.1
• PixelYourSite – Your smart PIXEL 11.0.1.1
• PixelYourSite – Your smart PIXEL 11.0.1.2
• PixelYourSite – Your smart PIXEL 11.0.2
• PixelYourSite – Your smart PIXEL 11.1.0
• PixelYourSite – Your smart PIXEL 11.1.1
• PixelYourSite – Your smart PIXEL 11.1.2
• PixelYourSite – Your smart PIXEL 11.1.3
• PixelYourSite – Your smart PIXEL 11.1.4
• PixelYourSite – Your smart PIXEL 11.1.4.1
• PixelYourSite – Your smart PIXEL 11.1.4.2
• PixelYourSite – Your smart PIXEL 11.1.5
• PixelYourSite – Your smart PIXEL 11.1.5.1
• PixelYourSite – Your smart PIXEL 11.1.5.2
• PixelYourSite – Your smart PIXEL 11.2.0