Books Gallery CVE-2026-108487

Exploitation requires an authenticated WordPress account with at least low-level posting privileges (PR:L) to inject the stored payload into a Books Gallery plugin input field, plus subsequent victim interaction (UI:R) - a privileged user or visitor must view the page where the payload is rendered for the script to fire. This is not remote-unauthenticated: the need for a valid account and the reliance on a victim loading the malicious content materially limit real-world risk, and exposure is confined to sites running the Books Gallery plugin at version 4.8.4 or earlier.

This is a moderate-severity stored XSS (CWE-79) in the WordPress 'Books Gallery' plugin, rated CVSS 6.5 by Patchstack. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation but requires an authenticated low-privilege account (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in the browser context of other users. No EPSS score, KEV listing, SSVC decision, or public POC was provided in the input, so there is no signal of active or widespread exploitation - meaning this is a real-but-routine issue to patch rather than an emergency. The limited C:L/I:L/A:L impacts are consistent with typical stored XSS (session/credential theft, defacement, limited admin-action forgery) rather than direct server compromise. Net assessment: genuine vulnerability worth remediating on a normal patch cycle; not a high-urgency priority absent evidence of exploitation.

A low-privileged authenticated user (e.g., a contributor or author) submits a book entry containing a malicious script payload through an input field that the plugin fails to neutralize. When an administrator or other user later views the affected page in wp-admin or on the front end, the stored script executes in their browser, enabling session hijacking or actions performed as the victim. No public proof-of-concept was identified in the provided data.