Lifecycle Timeline
2DescriptionNVD
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Reflected XSS.This issue affects CSS3 Compare Pricing Tables for WordPress: from n/a through <= 11.6.
AnalysisAI
Reflected cross-site scripting (XSS) in the CSS3 Compare Pricing Tables for WordPress plugin through version 11.6 allows unauthenticated remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper input neutralization during web page generation, enabling attackers to steal session cookies, perform actions on behalf of victims, or redirect users to malicious sites through specially crafted URLs. No public exploit code or active exploitation has been confirmed, and the low EPSS score (0.04%, 13th percentile) suggests limited real-world attack likelihood despite the XSS vector.
Technical ContextAI
The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS flaw in a WordPress plugin used to display pricing table grids. The plugin fails to sanitize or validate user-supplied input before echoing it back in HTTP responses, allowing attackers to inject arbitrary JavaScript that executes in the context of the victim's browser. Reflected XSS differs from stored XSS in that it requires victims to click a malicious link; the payload is not permanently stored on the server. The affected product is the CSS3 Compare Pricing Tables for WordPress plugin (CPE context: WordPress plugin slug 'css3_web_pricing_tables_grids') versions up to and including 11.6.
Affected ProductsAI
The CSS3 Compare Pricing Tables for WordPress plugin, developed by QuanticaLabs, is affected in versions from an unspecified baseline through version 11.6. The plugin is identified by the WordPress plugin slug 'css3_web_pricing_tables_grids'. Further details are available in the Patchstack vulnerability database entry linked in the references.
RemediationAI
Update the CSS3 Compare Pricing Tables for WordPress plugin to a version newer than 11.6 as soon as a patched release is available from the plugin vendor. Website administrators should check the plugin's release history on WordPress.org or the vendor's site for the next available version. In the interim, consider disabling the plugin if it is not actively required, or restrict access to pricing table pages if possible. Users should also educate their audience to avoid clicking suspicious links that could deliver the XSS payload. For current vulnerability details and patch availability confirmation, refer to the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/css3_web_pricing_tables_grids/vulnerability/wordpress-css3-compare-pricing-tables-for-wordpress-plugin-11-6-reflected-cross-site-scripting-xss-vulnerability.
Share
External POC / Exploit Code
Leaving vuln.today