CVE-2024-13628: 
WordPress vulnerability analysis and mitigation

The WP Pricing Table WordPress plugin through version 1.1 contains a Reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-13628. The vulnerability exists because the plugin fails to properly sanitize and escape parameters before outputting them back in the page (WPScan).

The vulnerability is a Reflected XSS issue that occurs when user input is not properly sanitized before being reflected back to users. The vulnerability can be exploited through the wp-admin/admin.php endpoint using specific parameters. The CVSS score for this vulnerability is rated as 7.1 (High), and it is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) (WPScan).

The vulnerability could be exploited against high-privilege users such as administrators. Successful exploitation could allow attackers to execute arbitrary web scripts or HTML in the context of the targeted user's browser session (WPScan).

A proof of concept exists demonstrating the vulnerability can be exploited via a specifically crafted URL targeting the plugin's admin page: https://example.com/wp-admin/admin.php?page=wp-pricing-table-menu&action=new">alert(1)&table_id=1">alert(1) (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the WP Pricing Table plugin should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (WPScan).