Unprotected Against Reflected Cross-Site Scripting in Easy Pricing Tables

CVE-2024-8871

Summary

The Easy Pricing Tables plugin for WordPress contains a vulnerability that allows unauthenticated attackers to initiate Reflected Cross-Site Scripting (XSS) attacks. This is due to the improper handling of user input with the add_query_arg function, which fails to adequately escape URL parameters. As a result, attackers could inject malicious scripts into web pages, exploiting unsuspecting users who are tricked into clicking on specially crafted links. This vulnerability affects all versions of the plugin up to and including 3.2.5, posing a significant risk to the security of websites utilizing this plugin.

References