CVE-2026-87888

YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.

Affected

YayPricing

CVSS v3.1 CNA

8.0 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

0.41% chance of exploitation in the next 30 days, 34th percentile

Published

2026-09-12

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/19bc425d-2aa3-4b2b-bc66-ac5ea96502e0/

References

• CVE Record
• NVD entry