Technical impact
The vulnerability is a cross‑site scripting flaw (CWE‑79) based on improper neutralization of user input that results in reflected XSS in the CSS3 Compare Pricing Tables for WordPress plugin. A malicious actor could inject JavaScript that is subsequently executed in the browser of any user who views the affected page. The attack can lead to credential theft, session hijacking, defacement, or the delivery of phishing content, impacting confidentiality, integrity, and availability of the site for end users. These specific consequences are inferred from common XSS exploitation scenarios, as the CVE description does not explicitly state them.
Affected Systems
QuanticaLabs supplies the CSS3 Compare Pricing Tables for WordPress plugin. All installed releases from the initial release through version 11.6 are affected. The vulnerability does not appear in versions 11.7 and later.
Risk and Exploitability
This flaw carries a CVSS score of 7.1, indicating a high risk, but an EPSS score of less than 1% suggests that exploitation is unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. Because the XSS payload is reflected in user-supplied data, an attacker would need to convince a victim to visit a specially crafted URL or interact with a form; thus the likely attack vector is social‑engineering or phishing. No special privileges are required, and the vulnerability can affect any user who can view the affected pages.
EUVD