Pricing Table
Monthly
Stored cross-site scripting in the Pricing Table WordPress plugin (versions 1.0.7 through before 2.1.5) lets an authenticated user with contributor-level access or higher save a link value using a script-bearing scheme such as javascript: inside one of the plugin's blocks; that value is rendered without scheme validation and executes in the browser of another, typically higher-privileged user who views and interacts with the affected pricing table content. Vendor-released patch: 2.1.5, and publicly available exploit code exists, though CISA's SSVC assessment records no active exploitation, the issue is not KEV-listed, and EPSS is low at 0.18% (8th percentile). Practical exposure is limited because the attacker needs a pre-provisioned low-trust account and a second user must interact with the poisoned block, which places this in the moderate tier despite its base score.
Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Pricing Table by PickPlugins plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button Link in all versions up to, and including, 1.12.10 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in the Pricing Table WordPress plugin (versions 1.0.7 through before 2.1.5) lets an authenticated user with contributor-level access or higher save a link value using a script-bearing scheme such as javascript: inside one of the plugin's blocks; that value is rendered without scheme validation and executes in the browser of another, typically higher-privileged user who views and interacts with the affected pricing table content. Vendor-released patch: 2.1.5, and publicly available exploit code exists, though CISA's SSVC assessment records no active exploitation, the issue is not KEV-listed, and EPSS is low at 0.18% (8th percentile). Practical exposure is limited because the attacker needs a pre-provisioned low-trust account and a second user must interact with the poisoned block, which places this in the moderate tier despite its base score.
Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Pricing Table by PickPlugins plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button Link in all versions up to, and including, 1.12.10 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.