CVE-2026-86797 Pricing Table CVE debrief

Who should care

Administrators of WordPress installations with the Pricing Table plugin, security teams, and developers responsible for maintaining and updating WordPress plugins should assess exposure and prioritize remediation.

Why it matters

CVE-2026-86797 is a stored XSS vulnerability in the Pricing Table WordPress plugin that allows users with contributor-level access and above to store malicious scripts. Defenders should prioritize verifying plugin versions, assessing exposure, and implementing compensating controls to detect potential attacks.

• Stored XSS attacks can lead to malicious script execution, potentially resulting in unauthorized actions or data breaches.
• Defenders must verify the versions of the Pricing Table plugin in use and assess exposure to prioritize remediation.
• The vulnerability allows users with contributor-level access and above to store malicious scripts, increasing the attack surface.
• Remediation requires updating the plugin to version 2.1.5 or later.

Technical summary

The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing users with contributor-level access and above to store malicious scripts that execute when another user views and interacts with the affected content. This issue arises from the plugin's failure to properly sanitize user input, potentially leading to unauthorized script execution. Defenders should prioritize verifying plugin versions, assessing exposure, and implementing compensating controls to detect potential attacks.

Defensive priority

Defenders should prioritize verifying the versions of the Pricing Table plugin in use and assessing exposure, as the vulnerability allows for stored XSS attacks. This requires immediate attention from administrators of WordPress installations with the affected plugin.

Recommended defensive actions

• Verify the version of the Pricing Table plugin and ensure it is updated to 2.1.5 or later.
• Assess exposure and prioritize remediation for WordPress installations with the affected plugin.
• Monitor for suspicious activity and implement compensating controls to detect potential stored XSS attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. However, details about exploitation, impact, and remediation are limited. Defenders should verify plugin versions, assess exposure, and implement compensating controls to detect potential attacks. The vulnerability allows users with contributor-level access and above to store malicious scripts, increasing the attack surface. There is no information on public exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.