Description
Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
Published: 2026-07-23
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The CVE describes a contributor‑side Cross Site Scripting flaw in the BSK PDF Manager plugin for WordPress, affecting all releases up to and including version 3.8. An attacker is able to provide input that the plugin subsequently renders without proper sanitisation, allowing execution of arbitrary JavaScript in the context of the site.

Affected Systems

The BSK PDF Manager plugin from bannersky, versions 3.8 and older, is vulnerable. Any WordPress site with this plugin installed exposes a risk of XSS if a contributor role is available to submit content. Site administrators should verify the installed plugin version and take corrective action.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity, and the EPSS score being below 1% indicates a low probability of exploitation at present. The vulnerability is not listed in CISA's KEV catalogue. Based on the description the attack vector requires a contributor role to submit input, making it an authenticated threat likely limited to users with such permissions.

Generated by OpenCVE AI on August 3, 2026 at 21:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the BSK PDF Manager plugin to the latest available version, which patches the XSS flaw.
  • If an upgrade is not immediately possible, disable the plugin or restrict contributor privileges to prevent malicious input.
  • Deploy a Content Security Policy that blocks inline scripts to mitigate the impact of any remaining injection attempts.

Generated by OpenCVE AI on August 3, 2026 at 21:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Bannersky
Bannersky bsk Pdf Manager
Wordpress
Wordpress wordpress
Vendors & Products Bannersky
Bannersky bsk Pdf Manager
Wordpress
Wordpress wordpress

Thu, 23 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 11:45:00 +0000

Type Values Removed Values Added
Description Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
Title WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Bannersky Bsk Pdf Manager
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-23T13:26:07.357Z

Reserved: 2026-07-22T08:54:08.235Z

Link: CVE-2026-65528

cve-icon Vulnrichment

Updated: 2026-07-23T13:26:02.587Z

cve-icon NVD

Status : Deferred

Published: 2026-07-23T12:18:45.640

Modified: 2026-07-23T14:17:58.047

Link: CVE-2026-65528

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T22:00:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')