A stored Cross-Site Scripting vulnerability in the YayPricing WordPress plugin allows authenticated users to execute arbitrary JavaScript within the administrative session, posing a high risk to site integrity.

The plugin fails to perform necessary capability checks on a REST API route designed for saving pricing rules. This flaw enables any authenticated user, including those with the subscriber role, to store malicious JavaScript that triggers when an administrator accesses the plugin settings page.

Successful exploitation allows an attacker to execute scripts in the context of an administrator session. This could lead to full administrative account takeover, unauthorized modification of site content, or the redirection of site traffic, severely compromising the security and reputation of the business. Given the CVSS score of 8.0, this represents a high-severity risk that requires immediate attention to prevent unauthorized administrative actions.

Immediate Action: Update the YayPricing WordPress plugin to version 3.5.7 or later to implement the required authorization checks.

Proactive Monitoring: Review administrative audit logs for any suspicious plugin settings changes or unauthorized REST API requests originating from low-privileged user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious script injections in REST API payloads until the plugin can be patched.

Public Exploit Available: Unknown.

The vulnerability presents a significant risk by allowing privilege escalation via script injection. IT administrators must prioritize the update to version 3.5.7 immediately to close the authorization gap. Failure to apply this patch leaves the administrative interface exposed to malicious actors who have gained basic subscriber access to the platform.