[To the blog](https://88lab.eu/en/blog/) [Wordpress](https://88lab.eu/en/category/wordpress/) # Critical Stored XSS Attack via WooCommerce + PixelYourSite Evgeny Dimitrov 14 February 2026 2 min read  In this article + [Let's discuss your project](https://88lab.eu/en/contact/) On February 14, 2026, we detected a real and working **Stored XSS attack** carried out through a fake WooCommerce order and exploiting the way PixelYourSite records the HTTP Referer. This is not a hypothesis. It happened in production. ## How the attack works - The attacker creates a fake order. - They manipulate the HTTP Referer header. - PixelYourSite records the referrer as “Traffic Source” in the order meta. - The data is displayed in the admin panel without escaping. - When the order is opened, the browser executes the malicious JavaScript. - The script: - Loads /wp-admin/user-new.php - Extracts the CSRF nonce - Creates a new administrator account via the active admin session There is no brute force. There is no breach in WordPress. Your own admin session is used. [RELATED TOPICS: Watch out for Google Core Vitals](https://88lab.eu/en/vnimavajte-s-google-core-vitals/) ## The real timeline 07:01 - Fake order opened 07:01 - The malicious