CVE-2026-6808 is a reflected cross-site scripting vulnerability in the Pricing Tables for WP plugin for WordPress, affecting all versions up to and including 1.1.0. The issue stems from improper neutralization of input in the 'page' parameter, allowing injection of arbitrary web scripts. This vulnerability can be exploited by unauthenticated attackers who can trick an administrator into clicking a malicious link, resulting in script execution within the administrator's context. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

Exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of an administrator's browser session. This may lead to partial disclosure of information and modification of data accessible to the administrator. There is no impact on availability. The vulnerability requires user interaction (clicking a crafted link) and does not require authentication. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when clicking links related to the Pricing Tables for WP plugin and consider restricting access to the plugin's administrative interfaces. Monitoring for updates from the vendor is recommended to apply any forthcoming patches promptly.