BSK PDF Manager CVE-2026-108498

Exploitation requires the BSK PDF Manager plugin (version ≤3.8.1) installed on a WordPress site, and an actor able to submit input into a plugin-controlled field so the malicious script is stored. Triggering requires a victim (UI:R in the CVSS vector - typically an administrator or other user) to subsequently load the page or admin view that renders the unsanitized stored input; it does not fire until that view occurs. Although the input vector asserts PR:N, stored XSS in this plugin realistically depends on having at least a low-privilege authenticated role or access to a content-submission surface to persist the payload - this limiting factor should be confirmed against the plugin's actual input paths. Sites where only trusted administrators can submit plugin content, or that have patched past 3.8.1, are not realistically exposed.

This is a Patchstack-reported stored XSS (CWE-79) in the BSK PDF Manager WordPress plugin affecting all versions through 3.8.1, rated CVSS 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The signals point to moderate, not critical, real-world risk: there is no EPSS score, no CISA KEV listing, and no public exploit identified, so there is no indication of active or imminent widespread exploitation. The CVSS vector claims PR:N (unauthenticated), but stored XSS in a PDF-management plugin almost always requires some authenticated capability to persist the payload (e.g., a contributor/author/editor submitting content or PDF metadata) - this PR:N value should be treated skeptically and verified, as Patchstack scoring for stored XSS sometimes assigns PR:N when input originates from low-privilege or form-facing surfaces. The required UI:R (a victim, typically an administrator, must view the affected page) and the scope change (S:C, script executing in the victim's browser context) are consistent with stored XSS, and the Low/Low/Low impact reflects session/content-level compromise rather than full system takeover. Net: a legitimate issue worth patching on exposed multi-user sites, but a high-CVSS-but-moderate-real-risk item absent any exploitation evidence.

An attacker with the ability to submit content to a WordPress site running BSK PDF Manager ≤3.8.1 injects a malicious script payload into a plugin-handled field (such as PDF metadata or a managed entry). When an administrator or other user later views the page or admin screen that renders this stored input, the script executes in their browser session. No public exploit code has been identified at time of analysis.