CVE-2026-108487

MediumCVSS 6.5

Published: 13/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

The Books Gallery plugin up to version 4.8.4 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.

Risk Assessment

The risk involves potential session hijacking, data theft, or malware distribution within the WordPress site context. Both administrators and visitors may be affected.

Recommendation

It is recommended to immediately update the Books Gallery plugin to the latest version that includes the fix. Also, regularly check for and apply available updates.

Other vulnerabilities in Books Gallery

CVE-2026-96822Critical
The Books Gallery plugin in versions up to and including 4.8.3 contains an unauthenticated SQL injection vulnerability. An attacker can execute malicious SQL queries without logging in.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak Books Gallery wp-books-gallery allows Stored XSS.This issue affects Books Gallery: from n/a through 4.8.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS