The wpdevart Pricing Table builder plugin is vulnerable to a CSRF-based Stored XSS attack, which could allow an unauthenticated attacker to execute malicious scripts in the context of an administrator session.

This vulnerability is a CSRF-to-XSS flaw where the application fails to validate requests, allowing an attacker to trick an authenticated user into performing unauthorized actions that result in the injection of malicious scripts. The attack vector is network based and does not require prior authentication by the attacker, though it requires user interaction.

The potential impact of this vulnerability is significant, as successful exploitation could lead to full account takeover or unauthorized administrative actions within the WordPress environment. Given the CVSS score of 8.8, this flaw represents a high risk to business operations, potentially resulting in data exfiltration, the redirection of site traffic, or the defacement of professional web assets.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate and remove the wpdevart Pricing Table builder plugin until an official security update is released by the vendor.

Proactive Monitoring: Security teams should monitor web server access logs for unusual POST requests originating from unexpected sources that target the plugin configuration endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious cross-origin requests and filter common XSS injection patterns to mitigate the risk of exploitation.

Public Exploit Available: No (exploit_available: false)

Due to the high CVSS severity score, this vulnerability should be treated with urgency. Administrators must prioritize the removal of the vulnerable plugin from their environment to eliminate the attack surface until the developer provides a verified, secure version.