CVE-2026-8627 is a reflected XSS vulnerability in the Correct Prices WordPress plugin (lykich) versions up to 1.0. The vulnerability arises because the correct_prices_page() function echoes the $_SERVER['PHP_SELF'] variable directly into a form's action attribute without sanitization or escaping. Since PHP_SELF reflects attacker-controlled path information, an attacker can inject malicious markup by breaking out of the attribute context. This vulnerability allows unauthenticated attackers to execute arbitrary scripts in the context of a victim's browser if the victim clicks a crafted link.

Successful exploitation can lead to the execution of arbitrary JavaScript in the context of the affected site for users who click on a maliciously crafted URL. This can result in theft of user credentials, session hijacking, or other client-side attacks. The vulnerability does not require authentication and affects the confidentiality and integrity of user interactions with the site. There is no indication of impact to availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking suspicious links that target the affected plugin. Site administrators may consider temporarily disabling the plugin or applying manual code sanitization and escaping of the PHP_SELF variable in the plugin source code to mitigate the risk.