CVE-2026-6808: Pricing Tables for WP XSS Vulnerability

CVE-2026-6808 Overview

CVE-2026-6808 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Pricing Tables for WP plugin for WordPress. The flaw affects all versions up to and including 1.1.0 and resides in the handling of the page parameter within the plugin's admin interface. The root cause is insufficient input sanitization and output escaping in OPT/Admin/Pages/Main.php. Unauthenticated attackers can craft a malicious URL that injects arbitrary JavaScript into the rendered page. Exploitation requires user interaction — an administrator must click the attacker-controlled link for the payload to execute in their browser session.

Critical Impact
Successful exploitation enables session theft, administrative action hijacking, and arbitrary script execution in the context of an authenticated WordPress administrator.

Affected Products

Pricing Tables for WP plugin for WordPress (awesome-pricing-tables-lite-by-optimalplugins)
All plugin versions from initial release through 1.1.0
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2026-05-12 - CVE-2026-6808 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-6808

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw classified under [CWE-79]. The plugin reads the page query parameter passed to the WordPress admin interface and reflects its value back into the HTML response without proper sanitization or contextual output escaping. Because the reflection occurs server-side and the response is rendered in the administrator's browser, an attacker-supplied script payload executes with the privileges of the logged-in admin. The vulnerable code path is in OPT/Admin/Pages/Main.php at line 44 of the plugin's 1.1.0 release. Refer to the WordPress Plugin Source Code for the specific reflection point.

Root Cause

The root cause is missing input sanitization on the page request parameter combined with absent output escaping when the value is written into the HTML response. WordPress provides helper functions such as sanitize_text_field() for input handling and esc_attr() or esc_html() for output, but the affected code path does not apply them before echoing the value.

Attack Vector

The attack is network-based and requires user interaction. An attacker constructs a URL targeting the plugin's admin page with a JavaScript payload embedded in the page parameter. The attacker then delivers the URL through phishing, a malicious referrer, or a compromised third-party site. When an authenticated WordPress administrator clicks the link, the payload reflects into the rendered admin page and executes in their browser session. The script can exfiltrate cookies, perform privileged actions through the WordPress REST API, create new admin accounts, or inject backdoor content into the site.

The vulnerability mechanism is documented in the Wordfence Vulnerability Details advisory. No verified proof-of-concept code is publicly available at this time.

Detection Methods for CVE-2026-6808

Indicators of Compromise

HTTP requests to WordPress admin URLs containing script tags, javascript: URIs, or HTML event handlers in the page query parameter
Web server access logs showing URL-encoded payloads such as %3Cscript%3E targeting /wp-admin/ paths associated with the plugin
Unexpected creation of WordPress administrator accounts or modification of user roles shortly after admin sessions
Outbound requests from administrator browsers to unknown domains immediately following admin panel navigation

Detection Strategies

Inspect web access logs for requests to wp-admin/admin.php with anomalous page parameter values containing HTML or JavaScript syntax
Deploy a web application firewall rule that blocks reflected XSS payloads against /wp-admin/ endpoints
Monitor for referrer headers originating from external phishing-style domains immediately preceding admin actions

Monitoring Recommendations

Enable WordPress audit logging to capture administrative actions, user role changes, and plugin installation events
Alert on first-seen administrator IP addresses or user-agent strings within session timelines
Correlate admin login events with subsequent privileged changes to detect post-XSS account takeover

How to Mitigate CVE-2026-6808

Immediate Actions Required

Identify all WordPress instances running the Pricing Tables for WP plugin at version 1.1.0 or earlier
Deactivate and remove the plugin until a patched release is available, or restrict access to /wp-admin/ via IP allowlisting
Force a password reset and session invalidation for all WordPress administrator accounts as a precaution
Audit recent administrator activity for unauthorized user creation, theme or plugin changes, and content modification

Patch Information

At the time of NVD publication on 2026-05-12, no fixed version of the Pricing Tables for WP plugin has been confirmed in the available references. Monitor the WordPress Plugin Code Reference and the Wordfence Vulnerability Details advisory for the release of a patched version, and apply it as soon as it becomes available.

Workarounds

Remove or deactivate the plugin until a vendor patch is released
Restrict access to the WordPress admin interface using IP allowlisting at the web server or WAF layer
Deploy a WAF ruleset that blocks reflected XSS patterns in query parameters targeting /wp-admin/
Train administrators to avoid clicking unsolicited links that reference WordPress admin URLs

bash

# Example nginx configuration to restrict wp-admin to trusted IPs
location ~ ^/wp-admin/ {
    allow 203.0.113.0/24;   # trusted office range
    allow 198.51.100.42;    # admin VPN egress
    deny all;
    try_files $uri $uri/ /index.php?$args;
}