Executive brief
The Correct Prices plugin for WordPress, which helps manage product pricing, contains a security flaw that allows for reflected cross-site scripting. An attacker can trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's browser. This could lead to the theft of sensitive information, such as login cookies, or the performance of unauthorized actions on behalf of the user.
Technical details
The Correct Prices plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper handling of the $_SERVER['PHP_SELF'] variable within the correct_prices_page() function. The function echoes this variable directly into a form's action attribute without sufficient sanitization or output escaping (e.g., using esc_url() or esc_attr()). Since PHP_SELF includes attacker-controlled path information appended to the URL, an unauthenticated attacker can craft a malicious link that, when clicked by a user, executes arbitrary JavaScript in the context of the user's session. This vulnerability affects all versions up to and including 1.0.
Affected products
- WordPress Correct Prices up to and including 1.0
Timeline
- 2026-05-20: disclosed: Initial publication of the CVE record.