Medium severity · published Oct 30, 2024
CVE-2024-8871
Pricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.5 - Reflected Cross-Site Scripting
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PT
Pricing Table WordPress Plugin – Easy Pricing Tables · fatcatapps
through 3.2.5 · source: vendor
Affected product
PT
Pricing Table WordPress Plugin – Easy Pricing Tables
fatcatapps
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8871
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8871
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/easy-pricing-tables/trunk/includes/ept-block.php#L304
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/easy-pricing-tables/trunk/includes/notices/notices.php#L91
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/a5e4f40b-c028-4283-ba02-c77408136713?source=cve
More from Pricing Table WordPress Plugin – Easy Pricing Tables
5.4
CVE-2024-8323
Pricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fontFamily Attribute