Login Request a demo
Medium severity · published Nov 6, 2024
CVE-2024-8323
The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fontFamily’ attribute in all versions up to,…
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fontFamily’ attribute in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Easy Pricing Tables · Fatcatapps
before 3.2.7 · source: NVD
Affected product
EP
Easy Pricing Tables
Fatcatapps
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8323
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8323
Product
https://plugins.trac.wordpress.org/browser/easy-pricing-tables/trunk/includes/ept-block.php#L18
Patch
https://plugins.trac.wordpress.org/changeset/3181961/
Release Notes
https://wordpress.org/plugins/easy-pricing-tables/#developers
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/68fb1fd3-16aa-467f-b5f6-a6126b05e088?source=cve
More from Easy Pricing Tables
8.5
CVE-2026-94115
WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability
6.5
CVE-2021-25098
The Pricing Tables WordPress Plugin WordPress plugin before 3.1.3 does not verify the CSRF nonce when removing posts, allowing attackers to make a logged in admin remove arbitrary…
6.1
CVE-2022-1904
The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any user (both…
4.8
CVE-2021-36866
Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Easy Pricing Tables plugin <= 3.1.2 at WordPress