Pricing Table CVE-2026-86797

Exploitation requires an authenticated account with contributor-level privileges or higher on the target WordPress site, and specifically targets the plugin block that renders a user-supplied link value without scheme validation (allowing script-bearing schemes such as javascript:). It is NOT self-triggering: a second, typically higher-privileged user must view and interact with the stored malicious pricing-table content for the payload to execute. Limiting factors: requires a pre-provisioned low-trust account (contributor), requires victim user interaction (UI:R), and only affects sites running Pricing Table versions 1.0.7 through before 2.1.5; sites that restrict contributor registration or have patched to 2.1.5+ are not exposed.

This is a stored XSS (CWE-79) in the Pricing Table WordPress plugin that realistically sits in the moderate tier despite its 6.8 base score. The provided CVSS vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) rates high/high/high impact, but this conflicts with the description: stored XSS does not typically cause total loss of confidentiality, integrity AND availability of the underlying system, and the vector's PR:H contradicts the description's 'contributor-level access and above,' which is a LOW-privilege authenticated role in WordPress - verify privilege level with WPScan/vendor. EPSS is low (0.18%, 8th percentile) and SSVC records Exploitation: none and Automatable: no, both consistent with the fact that exploitation requires an authenticated contributor account plus a second victim user viewing/interacting with the malicious content - i.e., not a mass-exploitable, drive-by remote flaw. Countervailing this, a public exploit exists (WPScan) and SSVC Technical Impact is 'Total.' Net: a real but conditional issue best treated as a patch-in-normal-cycle priority rather than an emergency, driven primarily by the need for a pre-existing low-trust authenticated account.

A user holding a contributor (or higher) account on a WordPress site running Pricing Table < 2.1.5 inserts a malicious link value (e.g., a javascript: scheme URI) into a pricing-table block, which the plugin renders without scheme validation. When an editor or administrator later previews or interacts with that content, the script executes in their authenticated browser session, potentially enabling session/action abuse or privilege escalation toward site takeover. A public exploit/advisory is available from WPScan.