Price Table Block <= 1.3.1 - Authenticated (Contributor+) CSS Injection via Block Style Attributes
- ID
- WPSEC-2026-3031
- Plugin
- Price Table Block (price-table-block)
- Affected
- from 1.2.2 before 1.3.2
- Remediation
- Update to 1.3.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-74
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- Price Table Block on WPSec AttackSurface
- Fix released
- Published
Description
The Price Table Block plugin for WordPress is vulnerable to CSS Injection via block style attributes (blockMeta, commonStyles, customCss) in all versions up to, and including, 1.3.1, due to insufficient sanitization of block CSS saved by users without the unfiltered_html capability before it is written to the post's public stylesheet. CSS comments could split keywords or sit inside url(), function names written with non-hex CSS escapes (such as u\rl() were not normalized, and an unclosed url() at the end of the CSS was left in place. This makes it possible for authenticated attackers with contributor-level access and above to inject CSS that loads off-site resources when the page or its preview is viewed, which can be used to send page data such as attribute values to an attacker-controlled host.
References
- https://wpsec.com/vuln/WPSEC-2026-3031/
- https://plugins.svn.wordpress.org/price-table-block/tags/1.3.2/
- https://wordpress.org/plugins/price-table-block/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS