SZB-01ac60c646
EUVD-2026-112995 reports PHP object injection in PixelYourSite product feed plugin
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- PixelYourSite
- Product
- Product Catalog Feed by PixelYourSite
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a PHP object injection flaw, scored 7.2 (CVSS v3.1), in Product Catalog Feed by PixelYourSite up to version 3.1.4. The listing was published 2026-10-29 and updated 2026-10-30.
If you use PixelYourSite
Update Product Catalog Feed by PixelYourSite to the latest vendor release
Restrict shop manager accounts to trusted users until patched
Review the plugin's changelog or vendor advisory for the fixed version
What the sources say 1
· Mastodon: “Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.” Source