The YayPricing WordPress plugin versions prior to 3.5.7 contain a CWE-79 Cross-Site Scripting vulnerability due to missing authorization checks on a REST route responsible for saving pricing rules. This flaw enables users with subscriber-level permissions or higher to store malicious JavaScript code. When an administrator accesses the YayPricing settings page, the injected script executes in their browser context, potentially leading to session hijacking or other browser-based attacks.

An attacker with subscriber or higher privileges can inject JavaScript that executes in an administrator's browser when they view the YayPricing settings page. This could lead to unauthorized actions performed with administrator privileges, including session theft or manipulation of the WordPress environment via the administrator's session.

A fix is available in YayPricing version 3.5.7 and later. Users should upgrade to version 3.5.7 or above to remediate this vulnerability. Until then, restrict subscriber-level users from accessing the affected REST route or the plugin settings page if possible.