The vulnerability is a stored Cross‑Site Scripting flaw that permits an attacker to inject malicious script into the MyBookTable Bookstore plugin’s output, which is then served to any visitor of the site. This flaw arises from insufficient input sanitization, allowing arbitrary code to persist in the database and be executed in the browser of visitors. The impact includes potential credential theft, defacement, or execution of further attacks such as session hijacking, thereby undermining the confidentiality, integrity, and availability of the affected web application.

All instances of the WordPress MyBookTable Bookstore plugin from the earliest releases through version 3.6.0 are affected, as the CVE description states the issue applies from "n/a" through "<= 3.6.0." The plugin is developed by zookatron and operates within the WordPress ecosystem.

The CVSS score of 5.9 denotes moderate severity, while the EPSS score of less than 1% reflects a low probability of current exploitation. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that an attacker can exploit the vulnerability by submitting malicious content through the plugin’s web interface, which is then stored and later rendered to site visitors, enabling a stored XSS attack path.