High severity · published Sep 12, 2026
CVE-2026-87888
YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
8.0
CVSS
0.4%
EPSS
No
On KEV
Description
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YA
YayPricing ·
before 3.5.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-87888
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-87888
wpscan.com
https://wpscan.com/vulnerability/19bc425d-2aa3-4b2b-bc66-ac5ea96502e0/
More from YayPricing
8.1
CVE-2026-15230
YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure