The vulnerability resides in the 'sidx' GET parameter of the Supsystic Pricing Table plugin, allowing unauthenticated attackers to execute arbitrary SQL queries against the underlying database. The same plugin also contains stored cross‑site scripting flaws in the 'Edit name' and 'Edit HTML' fields, so malicious scripts can be executed when anyone views a pricing table. Together, these issues can result in data compromise, database tampering, and the rendering of malicious content on visitor browsers.

WordPress sites that have installed Supsystic:Pricing Table version 1.8.7. No other products or versions are listed in the current data.

The CVSS score of 8.8 classifies this flaw as high severity. Attackers need only send a crafted HTTP GET request containing a malicious 'sidx' value; no authentication is required. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The lack of authentication and the straightforward request format make exploitation likely for automated tools targeting WordPress plugins.