CVE-2026-86797: CWE-79 Cross-Site Scripting (XSS) in Pricing Table

The Pricing Table WordPress plugin versions from 1.0.7 up to but not including 2.1.5 contain a stored Cross-Site Scripting (CWE-79) vulnerability. This occurs because the plugin does not properly validate the scheme of user-supplied link values before rendering them. As a result, users with contributor-level permissions or higher can inject malicious scripts that execute in the context of other users who view or interact with the compromised content.

An attacker with contributor-level access or higher can inject malicious scripts into the Pricing Table plugin content. These scripts execute in the browsers of other users who view or interact with the affected content, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires authenticated access at the contributor level or above, limiting exploitation to users with some level of trust within the WordPress site.

Upgrade the Pricing Table WordPress plugin to version 2.1.5 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is not explicitly stated in the input, but the affected versions are clearly defined as before 2.1.5, implying that 2.1.5 contains the fix.