PixelYourSite Professional vulnerabilities and threats

CVE-2026-32556 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in PixelYourSite Professional Boost versions up to and including 2.0.4. This vulnerability allows an attacker to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet.

CVE-2026-32555 is a critical unauthenticated SQL Injection vulnerability in PixelYourSite Professional Boost plugin versions up to and including 2.0.4. This flaw allows remote attackers to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently provided by the vendor.