CVE-2026-87888: YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated WordPress user with the subscriber role or a higher-privileged role can use the affected REST route to save malicious JavaScript in YayPricing pricing rules.
When does the stored JavaScript execute?
The payload executes in an administrator's browser when that administrator opens the YayPricing settings page on an affected installation.
Are unauthenticated visitors able to exploit it?
The available information indicates that exploitation requires an authenticated WordPress account with at least the subscriber role; unauthenticated exploitation is not described.
What should be done if an upgrade cannot be applied immediately?
Limit or remove subscriber-and-higher access for untrusted users where feasible, and avoid having administrators open the YayPricing settings page until the plugin can be updated. Review YayPricing pricing rules for unexpected or untrusted content.