What is the CVSS score of CVE-2026-6808?

CVE-2026-6808 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Pricing Tables for WP CVE-2026-6808

EUVD-2026-29410 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-8vvv-hf93-2h6f

WordPress XSS Wordpress Plugin Pricing Tables For Wp

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:46 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.1

DescriptionCVE.org

The Pricing Tables for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in Pricing Tables for WP plugin allows unauthenticated attackers to inject arbitrary JavaScript via the 'page' parameter. The vulnerability affects all versions up to 1.1.0 due to insufficient input sanitization and output escaping. Exploitation requires social engineering (e.g., tricking an administrator into clicking a malicious link), but no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in the WordPress admin interface component of the Pricing Tables for WP plugin. The 'page' parameter is processed in the Main.php file without proper sanitization or HTML entity encoding before being output to the page. This is a classic Stored or Reflected XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) where user-controlled input reaches the DOM without escaping functions like esc_attr(), esc_html(), or wp_kses_post(). The CPE cpe:2.3:a:optimalplugins:pricing_tables_for_wp indicates the affected software is the Pricing Tables for WP plugin published by Optimal Plugins. The vulnerability is exposed through the WordPress admin panel, which typically runs over HTTPS but may still be accessible to unauthenticated users if they possess valid credentials or if an authenticated user is exploited.

RemediationAI

Update the Pricing Tables for WP plugin to the latest available version above 1.1.0 immediately. Patch versions are available via the official WordPress Plugin Repository and should be installed through the WordPress admin panel (Plugins > Updates) or via direct upload if auto-updates are disabled. The primary fix requires sanitizing the 'page' parameter using WordPress escaping functions (wp_kses_post(), esc_attr(), or esc_html() depending on context) before output. If immediate patching is not possible due to compatibility concerns, restrict access to the WordPress admin panel (/wp-admin/) using network-level controls (IP whitelisting, WAF rules) to limit the pool of potential victims who could be phished. However, this is a temporary measure and does not eliminate the vulnerability. Additionally, disable the Pricing Tables for WP plugin if it is not actively in use, and educate administrators about phishing and social engineering risks targeting admin panel access. No known workarounds exist to disable the vulnerable 'page' parameter without code modification; patching is the definitive remediation.