CVE-2026-32545: Reflected XSS in Taboola Pixel

The primary impact of CVE-2026-32545 is the ability for an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can manifest in several ways, including stealing session cookies, redirecting users to malicious websites, or defacing the website. Successful exploitation requires an attacker to craft a malicious URL containing the XSS payload and trick a user into clicking it. The blast radius extends to any user visiting a page containing the vulnerable Taboola Pixel and the crafted URL. While no direct precedent is immediately apparent, XSS vulnerabilities are consistently exploited in real-world attacks, often targeting user credentials and sensitive data.

1. Reserved2026-03-12
2. Published2026-03-25
3. Modified2026-04-29
4. EPSS updated2026-04-02

The primary mitigation for CVE-2026-32545 is to upgrade the Taboola Pixel component to version 1.1.5 or later. If immediate upgrading is not feasible, consider implementing input validation and output encoding on any user-supplied data used within the Taboola Pixel. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Carefully review and sanitize any URLs passed to the Taboola Pixel to prevent malicious script injection. After upgrading, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) through a URL parameter and confirming that the script is not executed.

Active installs

400

Plugin rating

0.0

Requires WordPress

5.0+

Compatible up to

6.9.4

Requires PHP

7.4+