CVE-2026-1852

Product Pricing Table by WooBeWoo <= 1.1.0 - Cross-Site Request Forgery to Stored XSS and Pricing Table Deletion

Published Apr 15, 2026 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Description

The Product Pricing Table by WooBeWoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the updateLabel() and remove() functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages or delete pricing tables via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Analysis

Technical impact

The Product Pricing Table by WooBeWoo plugin for WordPress is vulnerable to Cross‑Site Request Forgery due to missing or incorrect nonce validation on the updateLabel() and remove() functions. An attacker who can entice a site administrator into visiting a crafted link can inject arbitrary scripts into the site’s pages or delete pricing tables. The injected scripts execute with the privileges of the logged‑in administrator, potentially exposing sensitive data or compromising site functionality.

Affected Systems

All versions of the Product Pricing Table by WooBeWoo plugin up to and including 1.1.0, which are installed on WordPress sites.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.1, indicating moderate severity. Exploit probability data is unavailable and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is through social engineering; an attacker sends a forged request to an administrator who mistakenly triggers the vulnerable action, thereby achieving the stored XSS and pricing table deletion outcomes.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

woobeewoo

Product Pricing Table by WooBeWoo

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.1.0

No data.

Vendor Product Versions

Woobeewoo

Product Pricing Table By Woobewoo

Version	Status	Scheme	Platform
`[0,1.1.0]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Product Pricing Table by WooBeWoo plugin to version 1.1.1 or later, which includes correct nonce validation for updateLabel() and remove() functions.
If an immediate upgrade is not possible, remove or comment out the updateLabel() and remove() functions from the plugin’s code to eliminate the CSRF entry points until a proper patch can be applied.
Apply the WordPress best practice of restricting plugin setting access to administrators only, and consider enabling two‑factor authentication for admin accounts to reduce the likelihood of accidental CSRF clicks.

Generated by OpenCVE AI on April 15, 2026 at 13:22 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.128% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/wpcodefactory/woo-product-pricing-tables/releases/tag/v1.1.1
https://www.wordfence.com/threat-intel/vulnerabilities/id/a3b459e0-4bd9-443e-96e4-91663a35c26e?source=cve

History

Apr 15, 2026 3:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Woobeewoo Woobeewoo product Pricing Table By Woobewoo Wordpress Wordpress wordpress
Vendors & Products		Woobeewoo Woobeewoo product Pricing Table By Woobewoo Wordpress Wordpress wordpress

Apr 15, 2026 1:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 15, 2026 11:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Product Pricing Table by WooBeWoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the updateLabel() and remove() functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages or delete pricing tables via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Title		Product Pricing Table by WooBeWoo <= 1.1.0 - Cross-Site Request Forgery to Stored XSS and Pricing Table Deletion
Weaknesses		CWE-352
References		https://github.com/wpcodefactory/woo-product-pricing-tables/releases/tag/v1.1.1 https://www.wordfence.com/threat-intel/vulnerabilities/id/a3b459e0-4bd9-443e-96e4-91663a35c26e?source=cve
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`