Critical Stored XSS Attack via WooCommerce + PixelYourSite

On February 14, 2026, we detected a real and working Stored XSS attackcarried out through a fake WooCommerce order and exploiting the way PixelYourSite records the HTTP Referer.

This is not a hypothesis. It happened in production.

How the attack works

1. The attacker creates a fake order.
2. They manipulate the HTTP Referer header.
3. PixelYourSite records the referrer as “Traffic Source” in the order meta.
4. The data is displayed in the admin panel without escaping.
5. When the order is opened, the browser executes the malicious JavaScript.
6. The script:
   • Loads /wp-admin/user-new.php
   • Extracts the CSRF nonce
   • Creates a new administrator account via the active admin session

There is no brute force. There is no breach in WordPress.
Your own admin session is used.

The real timeline

07:01 - Fake order opened
07:01 - The malicious <script> executes
07:09:33 - user-new.php loads in the background
07:09:42 - A new administrator is created
07:10 - Email received for a new user
07:10:35 - The account is deleted

The account existed for less than 1 minute.

What it looks like from the outside

The order looks completely normal:

• First and last name
• Real address
• Phone
• Email (often proton.me)
• Cash on delivery

The malicious code is hidden in the “Traffic Source” section of PixelYourSite.

There is no visual indicator.

Who is affected

Every WooCommerce store with active PixelYourSite that records the HTTP Referer and displays the meta data in the admin panel.

What you should do IMMEDIATELY

1. DO NOT OPEN ANY ORDERS

Do not open absolutely any orders in the admin panel,
before you deactivate PixelYourSite.

Every opened order can trigger XSS again.

2. Disable PixelYourSite

Temporarily turn off (Deactivate) the plugin until it is officially confirmed that the issue has been fixed.

3. Check for compromised accounts

wp-admin → Users
Look for unknown administrators.

4. Change WordPress salts

Generate new security keys and replace them in wp-config.php.

5. Check the database

Look for suspicious records in order meta:

• <script>
• <iframe>
• <img>
• Unknown domains

If you are not sure, run the check through the database (not through the admin interface).

Why this is serious

This is Stored XSS in an administrative environment.

The attacker:

• Does not hack WordPress directly
• Does not break passwords
• Does not use SQL injection

They wait for the administrator to open the order themselves.

One fake order is enough for full admin access.

Conclusion

Fake orders are no longer just spam.

They can be an entry point to a full administrative compromise.

If you manage a WooCommerce store, act immediately.
If you are an agency, notify your clients.

Security does not break from the inside.
It breaks when we trust user data without verification.