CVE-2026-86797

Deferred Deferred - Pending Action

Stored Cross-Site Scripting in Pricing Table WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing users with contributor-level access and above to store malicious scripts that execute when another user views and interacts with the affected content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-86797

EUVD

EUVD-2026-100854

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Pricing	Table 1.0.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Pricing Table WordPress plugin. It occurs because the plugin does not properly validate user-supplied link values in one of its blocks before rendering them. Attackers with contributor-level access or higher can inject malicious scripts that execute when other users view or interact with the affected content.

Detection Guidance

Check if the Pricing Table Block plugin version is between 1.0.7 and 2.1.4. Use WordPress admin to inspect plugin versions or run: wp plugin list --name='pricing-table-block' in WP-CLI.

Impact Analysis

If exploited, this vulnerability allows attackers to store malicious scripts on your WordPress site. When other users view or interact with the affected content, these scripts can execute, potentially leading to unauthorized actions, data theft, or session hijacking. It requires contributor-level access or higher to exploit.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Stored XSS attacks can expose sensitive user data, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the Pricing Table Block plugin to version 2.1.5 or later immediately. Restrict contributor-level and higher user roles to minimize exposure until updated.

Hi! I’m here to help you understand CVE-2026-86797. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70