The Pricing Table WordPress plugin, versions 1.0.7 through 2.1.4, fails to validate the scheme of a user‑supplied link in a pricing block, allowing users with contributor or higher privileges to inject malicious scripts that run when other visitors view the affected content. This stored XSS flaw can lead to defacement, credential theft, or other client‑side attacks against any user who opens the page containing the block.

WordPress sites using the Pricing Table plugin between versions 1.0.7 and 2.1.4 are impacted. The vendor is listed only as "Pricing Table," with no additional product detail, and affected versions span the full range of releases up to 2.1.4.

The vulnerability carries a CVSS score of 6.8, indicating moderate severity, and an EPSS score of less than 1 %, implying a low probability of exploitation in the wild. It is not included in the CISA KEV catalog. The attack requires a contributor‑level account to store the payload; once embedded, any visitor to the pricing block will execute the code. The stored nature of the flaw amplifies its impact, as the malicious script can persist indefinitely until the block is edited or the plugin is updated.