{"id":"CVE-2026-87888","state":"PUBLISHED","title":"YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route","description":"The YayPricing  WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing  WordPress plugin before 3.5.7's settings page.","publishedAt":"2026-09-12T06:00:12.672Z","updatedAt":"2026-09-12T15:29:41.359Z","severity":{"score":8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown YayPricing"],"affected":[{"vendor":"Unknown","product":"YayPricing","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.7","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/19bc425d-2aa3-4b2b-bc66-ac5ea96502e0/"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/87xxx/CVE-2026-87888.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-87888","state":"PUBLISHED","datePublished":"2026-09-12T06:00:12.672Z","dateUpdated":"2026-09-12T15:29:41.359Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-09-09T14:26:35.755Z"},"containers":{"cna":{"title":"YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route","descriptions":[{"lang":"en","value":"The YayPricing  WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing  WordPress plugin before 3.5.7's settings page."}],"affected":[{"vendor":"Unknown","product":"YayPricing","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.5.7","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/19bc425d-2aa3-4b2b-bc66-ac5ea96502e0/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-79 Cross-Site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-09-12T06:00:12.672Z"},"credits":[{"lang":"en","value":"Artus KG","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-09-12T15:16:15.606528Z","id":"CVE-2026-87888","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-12T15:29:41.359Z"}}]}}}