CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
The Pricing Table WordPress Plugin contains a stored cross-site scripting (XSS) vulnerability in versions up to 3.2.5. An attacker can inject malicious JavaScript into pricing table content, which executes in the browsers of site visitors. The vulnerability requires user interaction—a victim must view a page containing the injected payload. Successful exploitation can steal session cookies, redirect users, or deface page content.
What an attacker can do
Inject JavaScript that runs in visitors' browsers when they view affected pricing tables.
Potential impact on your site
Visitors to your site could be redirected, have their sessions hijacked, or see defaced content on pricing pages.
Conditions required to exploit
No authentication required. A site visitor must view a page containing the malicious pricing table.
Key dates
External resources
Related vulnerabilities
