The vulnerability resides in the Bg Book Publisher plugin for WordPress, where the book_author post meta is rendered through the [book_author] shortcode without proper escaping. This allows an authenticated user with contributor or higher privileges to inject arbitrary JavaScript into the meta value. When a web page containing the shortcode is viewed, the injected script runs in the victim’s browser, providing the attacker with the ability to interfere with client‑side operations.

All installations of the Bg Book Publisher plugin by vbog, in WordPress, with versions up to and including 1.25. No specific product variants are listed beyond the plugin.

The CVSS score of 6.4 indicates a medium severity. The EPSS score is below 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. An attacker must have authenticated contributor‑level access to insert malicious content into the book_author field. Once stored, the script executes in the browsers of users who view a page containing the [book_author] shortcode.