The BA Book Everything plugin is vulnerable to a stored cross‑site scripting flaw triggered through its babe‑search‑form shortcode. Insufficient sanitization and escaping of user‑supplied attributes allows an attacker who can add or edit content to insert arbitrary JavaScript into pages. When a victim loads the injected page, the script runs in the victim’s browser, potentially stealing credentials, session data, or defacing the site. The weakness corresponds to CWE‑79, a classic reflected/encoded script injection.

WordPress sites that have installed any version of the BA Book Everything plugin up to and including 1.8.14. Site owners who have granted contributor or higher permissions to users are at risk, as the attacker only needs such access to inject the malicious payload.

The CVSS score of 6.4 indicates medium severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it remotely by submitting a crafted URL or shortcode from a contributor account; the payload is stored within the plugin’s database and executed only when a page containing the shortcode is rendered to another user.