CVE-2026-87888

HighCVSS 8.0

Published: 12/09/2026(UTC)Updated: 14/09/2026(UTC)Translated: 12/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules. This allows users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing settings page.

Risk Assessment

A user with the subscriber role can inject malicious JavaScript that executes in the administrator's browser, potentially leading to administrator account takeover. The risk to site security is high.

Recommendation

Update the plugin to version 3.5.7 or later to fix the missing authorization check.

Other vulnerabilities in YayPricing

CVE-2026-66442Medium
The YayPricing plugin up to version 3.5.6 has a Broken Access Control vulnerability exploitable by a subscriber. This allows unauthorized access to functions or data.

Original NVD description (English source)

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS