CVE-2026-1852

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-1852
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1852.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-1852
Published
2026-04-15T11:30:25.272Z
Modified
2026-07-15T01:49:17.534484780Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Product Pricing Table by WooBeWoo <= 1.1.0 - Cross-Site Request Forgery to Stored XSS and Pricing Table Deletion
Details

The Product Pricing Table by WooBeWoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the updateLabel() and remove() functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages or delete pricing tables via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Database specific 
{
    "cna_assigner": "Wordfence",
    "cwe_ids": [
        "CWE-352"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1852.json"
}
References

Affected packages

Git / github.com/wpcodefactory/woo-product-pricing-tables

Affected ranges

Type
GIT
Repo
https://github.com/wpcodefactory/woo-product-pricing-tables
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
10a71e36ba428b32e6a880037dacff6dedc598e9
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.1.0"
        }
    ]
}

Affected versions

v1.*
v1.0.8
v1.0.9
v1.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1852.json"