Junglewise Threat Intelligence

CVE-2026-6808: OptimalPlugins Pricing Tables for WP reflected XSS in page parameter

CVE-2026-6808 · Severity: medium · CVSS 6.1 · Published 2026-05-12

Executive brief

The Pricing Tables for WP plugin for WordPress, which is used to create and manage product pricing displays, contains a security flaw that allows for reflected cross-site scripting. An attacker can exploit this by tricking a site administrator into clicking a malicious link, allowing the attacker to run unauthorized scripts in the administrator's browser. This could lead to unauthorized actions being performed on the website or the theft of sensitive session information.

Technical details

The Pricing Tables for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'page' parameter within the administrative interface. Specifically, the vulnerability exists in the OPT/Admin/Pages/Main.php file. An unauthenticated remote attacker can exploit this by crafting a malicious URL containing a script payload and persuading a logged-in administrator to visit the link. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, which can be used to hijack administrative sessions or modify site content. The issue affects all versions up to and including 1.1.0.

Affected products

  • OptimalPlugins Pricing Tables for WP (Awesome Pricing Tables Lite) Up to, and including, 1.1.0

Timeline

  • 2026-05-12: disclosed: Vulnerability published by Wordfence and NVD.

References