CVE-2026-65528
MediumCVSS 6.5Summary
The BSK PDF Manager plugin versions up to 3.8 contain a Cross Site Scripting (XSS) vulnerability exploitable by contributors. A contributor can inject malicious JavaScript code.
Risk Assessment
The risk includes session theft, redirection to malicious sites, or theft of data from visitors of the affected page.
Recommendation
Update the BSK PDF Manager plugin to the latest version and restrict contributor permissions.
Other vulnerabilities in BSK PDF Manager
See all- CVE-2026-39686Medium
The BSK PDF Manager plugin for WordPress (versions up to 3.7.2) exposes sensitive system information to unauthorized entities, allowing retrieval of embedded sensitive data.
- CVE-2025-4970Medium
The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to and including 3.7.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Administrator-level access and above to inject arbitrary web scripts that execute when a user accesses the SVG file. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS