The flaw is an improper neutralization of input during web page generation, leading to a stored XSS vulnerability within the BSK PDF Manager plugin. When malicious code is stored and later rendered, it executes in any victim’s browser, enabling theft of cookies, user impersonation, or malicious content injection. The vulnerability is classified as CWE‑79 and carries a CVSS base score of 7.1.

WordPress sites using the BSK PDF Manager plugin version 3.8.1 or earlier are affected. The vendor is Bannersky. No other affected product versions are listed beyond the 3.8.1 cutoff.

The CVSS score indicates high severity. The EPSS score of less than 1% suggests a low current exploitation probability. The flaw is not part of CISA’s KEV catalog. Based on the description, the likely attack vector involves an attacker with administrative or content‑creator privileges injecting malicious script into plugin‑stored data that later renders to all site visitors. The exploitation requires only the ability to write data that is subsequently displayed, making it relatively easy if the attacker can access the plugin’s admin interface.