high
advisory
PixelYourSite Product Catalog Feed: PHP Object Injection (CVE-2026-118078)
A PHP Object Injection vulnerability exists in the PixelYourSite Product Catalog Feed plugin (<= 3.1.4) affecting Shop manager accounts.
CVE search metadata
CVE search record: CVE-2026-118078. Severity: high. CVSS: 7.2. KEV: no. Product: Product Catalog Feed (<= 3.1.4). Brief: PixelYourSite Product Catalog Feed: PHP Object Injection (CVE-2026-118078). Brief link: https://feed.craftedsignal.io/briefs/2026-10-pixelyoursite-cve-2026-118078/
Triage facts
Revision 1- Applicability
- Product Catalog Feed (<= 3.1.4)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 17:36 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-118078 identifies a PHP Object Injection vulnerability in the PixelYourSite Product Catalog Feed plugin, version 3.1.4 and earlier. The vulnerability is exploitable by users with Shop manager privileges.