32 matches found
WordPress YayPricing plugin < 3.5.7 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin YayPricing versions 3.5.7...
CVE-2026-87888
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...
CVE-2026-87888 YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...
EUVD-2026-76801
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...
CVE-2026-87888 YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...
CVE-2026-87888
The YayPricing WordPress plugin (versions before 3.5.7 ) is vulnerable to a Stored XSS flaw due to a missing authorization check on a REST route used to save pricing rules. This allows users with the subscriber role and above to inject and store malicious JavaScript. If an administrator views the...
CVE-2026-87888: Improper Neutralization of Input During Web Page Generation
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...
PT-2026-90585
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...
WordPress YayPricing plugin < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure vulnerability
Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin YayPricing versions 3.5.7...
CVE-2026-15230 YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure
The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes...
EUVD-2026-53116
The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes...
CVE-2026-15230 YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure
The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes...
CVE-2026-15230: Improper Access Control
The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes...
CVE-2026-66442
Subscriber Broken Access Control in YayPricing = 3.5.6 versions...
CVE-2026-66442
CVE-2026-66442 concerns the WordPress plugin YayPricing <= 3.5.6 , reported as Broken Access Control . The CVE record cites a network-based issue with low persistence of impact: confidentiality = none, integrity = low, availability = low; privileges required = low, user interaction = none. No ...
CVE-2026-66442 WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in YayPricing = 3.5.6 versions...
CVE-2026-66442
Subscriber Broken Access Control in YayPricing = 3.5.6 versions...
EUVD-2026-49246
Subscriber Broken Access Control in YayPricing = 3.5.6 versions...