OrdaSoft Book Library (Free) CVE-2026-101111

Reflected XSS reachable on the PUBLIC book-detail page (view_book) of the Book Library (Free) OrdaSoft extension for Joomla, versions below 6.4.6 - no authentication or special configuration required to reach the vulnerable code path. Exploitation requires victim user interaction: the attacker must trick a user into opening a crafted link whose 'title' request parameter contains a double quote plus HTML/JavaScript, which breaks out of the double-quoted attribute in default.php. The primary limiting factor is this UI:P dependency (social engineering / link delivery); impact scales with the privileges of the victim whose browser executes the payload (an authenticated admin session yields higher impact than an anonymous visitor).

This is a genuine but modest-severity reflected XSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms network reach, no authentication, and no attack requirements, but exploitation is gated by user interaction (UI:P) - a victim must be lured into clicking an attacker-crafted link, since the payload is reflected from the request rather than stored. Impact is limited across the board (VC:L/VI:L/VA:L, SC/SI/SA:N), yielding a Medium 5.3. No exploitation-probability signals reinforce urgency: no EPSS score is provided, the CVE is not in CISA KEV, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description - both describe a remote, unauthenticated, victim-interaction reflected XSS. Net: a real, verifiable defect, but low real-world priority given the niche affected product, dependence on social engineering, and absence of any active-exploitation or exploit-availability signal.

An attacker crafts a URL to the public book-detail page with a 'title' parameter containing a double quote that closes the HTML attribute and appends a <script> or event-handler payload, then delivers it to a victim (phishing link, forum post, malicious ad). When the victim opens the link, their browser renders the injected JavaScript in the site's origin, enabling session-cookie theft, CSRF token exfiltration, or UI redress against the logged-in Joomla user. No public exploit code is referenced, but the flaw is trivially reproducible from the description.