CVE-2025-0769

🗓️ 28 Feb 2025 20:01:30Reported by Fluid AttacksType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 2113 Views🌐 WEB

CVE-2025-0769: PixelYourSite API Manager has an unserialize vulnerability due to unvalidated user input.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-0769	28 Feb 202523:43	–	circl
CNNVD	WordPress plugin PixelYourSite 代码问题漏洞	28 Feb 202500:00	–	cnnvd
Cvelist	CVE-2025-0769 PixelYourSite 10.1.1.1 - Insecure deserialization	28 Feb 202520:01	–	cvelist
EUVD	EUVD-2025-5934	3 Oct 202520:07	–	euvd
NVD	CVE-2025-0769	28 Feb 202520:15	–	nvd
Patchstack	WordPress PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin <= 10.1.1.1 - Unauthenticated PHP Object Injection vulnerability	4 Mar 202500:28	–	patchstack
Positive Technologies	PT-2025-9133 · Unknown · Pixelyoursite	28 Feb 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-0769	2 Mar 202520:20	–	redhatcve
Vulnrichment	CVE-2025-0769 PixelYourSite 10.1.1.1 - Insecure deserialization	28 Feb 202520:01	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (February 24, 2025 to March 2, 2025)	6 Mar 202517:06	–	wordfence

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "pixelyoursite",
    "vendor": "PixelYourSite",
    "versions": [
      {
        "status": "affected",
        "version": "10.1.1.1"
      }
    ]
  }
]

Source	Link
fluidattacks	www.fluidattacks.com/advisories/skims-23/
co	www.co.wordpress.org/plugins/pixelyoursite/

Parameter	Position	Path	Description	CWE
user_input	request body	myapp/modules/facebook/facebook-server-a sync-task.php	Unvalidated user input is passed to unserialize leading to PHP Object Injection.	CWE-502
unserialize_input	request body	myapp/modules/facebook/facebook-server-a sync-task.php	Unvalidated user input is passed to unserialize leading to PHP Object Injection.	CWE-502

15 Apr 2026 00:35Current

7.1High risk

Vulners AI Score7.1

CVSS 46.3

EPSS0.00139

SSVC

CWE-502