XSS in Yaypricing
CVE-2026-87888
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.
Vulnerability class: XSS (Cross-Site Scripting)
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Unknown Yaypricing
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-87888?
- CVE-2026-87888 is a high-severity vulnerability in Yaypricing, classified under Cross-site Scripting. CVSS score: 8.0/10. Published 2026-09-12.
- How severe is CVE-2026-87888?
- High severity. CVSS v3 base score is 8.0 out of 10.