CVE-2026-95530 is a CWE-79 cross-site scripting vulnerability in PixelYourSite – Your smart PIXEL (TAG) Manager versions up to 11.4.1. It allows an attacker with privileges equivalent to a subscriber to inject malicious scripts due to improper input neutralization during web page generation. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low complexity, required privileges of low level, user interaction needed, and impacts on confidentiality, integrity, and availability. No known exploits in the wild have been reported. No patch or remediation information is provided in the available data.

An attacker with subscriber-level privileges can exploit this vulnerability to execute arbitrary scripts in the context of other users, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact affects confidentiality, integrity, and availability but is limited by the required privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting subscriber privileges and applying web application firewall (WAF) rules to detect and block XSS attempts if feasible.