CVE-2026-108498
HighCVSS 7.1Summary
The BSK PDF Manager WordPress plugin up to version 3.8.1 does not properly neutralize input during web page generation, allowing Stored XSS. A malicious script stored in the application is later executed in other users' browsers.
Risk Assessment
An attacker can store malicious JavaScript that executes in the sessions of administrators and users, enabling cookie theft, account takeover, or content modification of the site.
Recommendation
Update the BSK PDF Manager plugin to a version later than 3.8.1 or disable it if no fix is available, and enforce input validation and sanitization.
Other vulnerabilities in BSK PDF Manager
See all- CVE-2026-65528Medium
The BSK PDF Manager plugin versions up to 3.8 contain a Cross Site Scripting (XSS) vulnerability exploitable by contributors. A contributor can inject malicious JavaScript code.
- CVE-2026-39686Medium
The BSK PDF Manager plugin for WordPress (versions up to 3.7.2) exposes sensitive system information to unauthorized entities, allowing retrieval of embedded sensitive data.
- CVE-2025-4970Medium
The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to and including 3.7.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Administrator-level access and above to inject arbitrary web scripts that execute when a user accesses the SVG file. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS