Booktics CVE-2026-109895

Exploitation requires a victim with an active session on a WordPress site running the Booktics plugin (versions up to and including 1.0.29) to be tricked into triggering attacker-controlled input that reaches a DOM sink - the UI:R requirement means the attack cannot succeed without victim interaction such as clicking a crafted link or visiting a malicious page. No authentication is required of the attacker (PR:N), but the impact is confined to the context of the interacting user's browser. The specific vulnerable feature/parameter is not detailed in the available data beyond the DOM-based XSS classification; limiting factors are the mandatory user interaction and dependence on the Booktics plugin being installed and active.

This is a moderate-severity DOM-based cross-site scripting flaw (CVSS 7.1) in the Arraytics Booktics WordPress plugin. The provided CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates a network-reachable, low-complexity, unauthenticated issue - but critically requires user interaction (UI:R), meaning a victim must be lured into triggering the malicious payload rather than the attacker exploiting a server directly. No EPSS score was supplied, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept is referenced; the only source is a single Patchstack advisory. Contrast of signals: the scope-change (S:C) and network vector push the score into the High band, but the UI:R requirement and the fact that XSS impacts are generally confined to the victim's browser session make real-world risk considerably lower than the 7.1 suggests. The input vector claims availability impact (A:L), which is atypical for reflected/DOM XSS and likely a conservative Patchstack scoring default rather than a genuine DoS - verify against actual behavior. Overall this is a 'high-CVSS-but-moderate-real-risk' client-side issue appropriate for routine patching, not emergency response.

An attacker crafts a URL or page containing a malicious script payload that the vulnerable Booktics plugin reflects into the DOM without proper neutralization. The attacker sends this link to a logged-in site user or administrator (e.g., via phishing); when the victim opens it, the script executes in their browser session in the context of the WordPress site. No public exploit code is currently identified, and successful exploitation depends on the victim clicking the attacker-supplied link (UI:R).