CVE-2026-87888: YayPricing WordPress Plugin XSS Vulnerability

CVE-2026-87888 Overview

CVE-2026-87888 is a stored Cross-Site Scripting (XSS) vulnerability in the YayPricing WordPress plugin versions prior to 3.5.7. The plugin exposes a REST route that saves pricing rules without performing an authorization check. Any authenticated user with the subscriber role or above can write arbitrary JavaScript into stored pricing rules. The payload executes when an administrator opens the plugin settings page in a browser session. The flaw is tracked under CWE-79 and enables privilege escalation through administrator session compromise.

Critical Impact
Low-privileged authenticated users can store JavaScript that executes in an administrator's browser, enabling site takeover through session theft or forced administrative actions.

Affected Products

YayPricing WordPress plugin versions before 3.5.7
WordPress sites permitting subscriber-level registration with YayPricing installed
Any WordPress deployment where untrusted users hold subscriber or higher roles alongside YayPricing

Discovery Timeline

2026-09-12 - CVE-2026-87888 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-87888

Vulnerability Analysis

The YayPricing plugin registers a REST API route that persists pricing rule configuration to the WordPress database. The route handler omits a capability check, so it authenticates the caller but never verifies whether the caller should modify plugin settings. WordPress considers any logged-in user, including subscribers, as authenticated for REST purposes. A subscriber can therefore submit a crafted request that stores malicious content inside pricing rule fields.

The stored content is later rendered inside the plugin's administrative settings interface without adequate output encoding. When an administrator opens the settings page, the browser parses and executes the injected script under the administrator's origin and session. The attacker gains the ability to perform any action the administrator can perform through the WordPress interface.

Root Cause

The root cause is a missing authorization check on a REST route, combined with insufficient output escaping on the admin settings page. The permission_callback for the affected route does not enforce a capability such as manage_options. Data supplied by low-privileged users flows into administrator-rendered HTML without sanitization through functions such as esc_html or wp_kses.

Attack Vector

Exploitation requires a valid subscriber account and requires an administrator to subsequently visit the plugin settings page. An attacker sends an authenticated HTTP request to the vulnerable REST endpoint with a JavaScript payload embedded in a pricing rule field. The payload persists in the database. When an administrator loads the settings page, the browser executes the script and can create a new administrator account, install a malicious plugin, exfiltrate secrets, or plant a persistent backdoor. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-87888

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or HTML event handlers stored in YayPricing rule records within the wp_options or plugin-specific tables
New WordPress administrator accounts created shortly after a subscriber account interacted with the REST API
Unauthorized plugin or theme installations following administrator visits to the YayPricing settings page
REST API requests from low-privileged accounts targeting YayPricing routes with unusually large or HTML-laden JSON bodies

Detection Strategies

Inspect WordPress access logs for POST requests to /wp-json/ routes belonging to YayPricing originating from subscriber-level session cookies
Query the database for YayPricing rule entries containing HTML tags, script fragments, or encoded JavaScript keywords such as onerror, onload, or eval
Compare current administrator user lists and installed plugin inventories against a known-good baseline to identify unauthorized additions

Monitoring Recommendations

Enable WordPress audit logging to record REST API calls, user role changes, and plugin installations
Alert on any HTTP request from non-administrator accounts that writes to plugin configuration endpoints
Monitor administrator browser sessions for anomalous outbound requests immediately after loading plugin settings pages

How to Mitigate CVE-2026-87888

Immediate Actions Required

Upgrade the YayPricing plugin to version 3.5.7 or later on all WordPress sites
Audit existing pricing rules for stored JavaScript payloads and remove any malicious entries before administrators load the settings page
Review WordPress user accounts and revoke any unexpected administrator privileges granted since the plugin was installed
Rotate administrator credentials and invalidate active sessions if evidence of exploitation exists

Patch Information

The vendor addressed CVE-2026-87888 in YayPricing version 3.5.7 by adding an authorization check to the affected REST route. Update through the WordPress plugin dashboard or by replacing the plugin files with the fixed release. Confirm the installed version reports 3.5.7 or higher after the update. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict user registration and disable the subscriber role on sites that do not require public account creation
Block access to the YayPricing REST namespace at the web server or web application firewall layer for non-administrator sessions until patching completes
Temporarily deactivate the YayPricing plugin if immediate patching is not possible and the site permits untrusted account registration

bash

# Configuration example
# Verify the installed YayPricing version using WP-CLI
wp plugin get yaypricing --field=version

# Update YayPricing to the patched release
wp plugin update yaypricing --version=3.5.7

# Disable open user registration as a hardening measure
wp option update users_can_register 0