CVE-2026-87888CWE-79cross-site-scripting

CVE-2026-87888

High · published September 12, 2026

CVSS v3.1
8.0
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-12T10:16Z
References (1)
https://wpscan.com/vulnerability/19bc425d-2aa3-4b2b-bc66-ac5ea96502e0/ · [email protected]
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 12 SEP 06:00Z
    YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
    cvelistv5