Improper neutralization of input during page generation allows an attacker to inject malicious scripts that are stored and executed in the browsers of visitors who view affected pages. This stored XSS can lead to session hijacking, credential theft, defacement, or the delivery of malware. The weakness is a classic cross‑site scripting flaw (CWE‑79).

WordPress sites using the MyBookTable Bookstore plugin from any version up to and including 3.6.0. This includes all earlier released versions, since the vulnerability exists from the plugin's introduction up to the stated limit.

The CVSS score is not provided, but the vulnerability enables arbitrary script execution with user‑facing impact. EPSS is not available, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector involves inserting malicious content through the plugin’s data entry interface; an attacker with sufficient permissions to add or edit book entries can embed JavaScript that will run for all site visitors. Therefore, sites that allow users beyond administrators to interact with this plugin remain at risk until the flaw is mitigated.