The Pricing Tables for WP plugin fails to sanitize or escape the 'page' query parameter, resulting in a reflected Cross‑Site Scripting vulnerability. When an attacker supplies a malicious payload in this parameter, the plugin outputs it directly to the admin page, allowing the payload to run in the browser of anyone who visits that URL.

All releases of the Pricing Tables for WP plugin by optimalplugins up to version 1.1.0 are affected. The vulnerable code resides in the admin pages that process the 'page' request variable, which are accessible through the WordPress administrative interface.

The CVSS score of 6.1 indicates moderate severity. There is no EPSS data, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; an unauthenticated attacker can craft a link containing a malicious 'page' parameter and entice an administrator to click it. The reflected XSS flaw allows client‑side scripts to execute within the context of the admin user, potentially enabling malicious actions such as phishing, content manipulation, or session data exfiltration.