CVE-2026-108498
7.1HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Attackers can execute malicious scripts in the context of a victim's session when an administrative user views stored content. Exploitation requires an unauthenticated attacker to inject input and a victim to view the affected page.
Root cause
The plugin fails to sanitize and neutralize user input before rendering it on the page, leading to stored cross-site scripting.
Affected systems
bannersky BSK PDF Manager through 3.8.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade to a version higher than 3.8.1 once released by the vendor, or deactivate and delete the plugin immediately if no patch is available.
$ wp plugin deactivate bsk-pdf-managerAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.