The Responsive Pricing Table plugin for WordPress is vulnerable to stored cross‑site scripting when an authenticated user with Author-level access or higher can submit data to the plan_icons field. Insufficient input sanitization and output escaping allow attackers to inject arbitrary JavaScript, which executes in the browser context of any site visitor who views a page containing the injected content. The weakness is a client‑side injection flaw (CWE‑79).

WordPress sites that have the Responsive Pricing Table plugin by spwebguy installed in versions 5.1.12 or earlier are affected. The plan_icons parameter is the attack vector in all releases up to and including 5.1.12.

The CVSS score of 6.4 indicates a moderate severity, while an EPSS score of 2% suggests the likelihood of exploitation is currently low but non‑negligible. The attacker must first log in with Author or higher privileges, so the vector is authenticated. Because the payload runs in visitors’ browsers, a moderate number of compromised content editors can create widespread impact. The issue is not yet listed in CISA KEV, meaning no documented widespread exploitation has been observed, but the presence of the flaw warrants prompt attention.