The Correct Prices plugin for WordPress contains a reflected cross‑site scripting vulnerability that arises when the plugin echoes the $_SERVER['PHP_SELF'] value into a form action attribute without sanitization or escaping. Because PHP_SELF can contain attacker‑controlled path components, a malicious actor can terminate the attribute and inject arbitrary JavaScript or other markup. An unauthenticated user can trigger this by opening a crafted link in the vulnerable WordPress site, which may result in session hijacking, data theft, or phishing attacks, depending on the information available to the victim’s browser.

WordPress sites running the Correct Prices plugin version 1.0 or earlier. The plugin is published by lykich:Correct Prices. Any installation that has not upgraded past version 1.0 is vulnerable.

The CVSS score of 6.1 indicates medium severity, and the absence of an EPSS rating suggests no known widespread exploitation yet. The vulnerability is not listed in the CISA KEV database, but the typical attack vector is through a web interface that requires a user to click a crafted link. Attackers do not need privileged access and can deliver the payload via any open link, making it reasonably easy to exploit in a social‑engineering context.