BA Book Everything CVE-2026-39786

Exploitation requires a successful social-engineering step: a victim (unauthenticated visitor or logged-in user/admin) must be induced to interact with an attacker-crafted request or link, per CVSS UI:R. No authentication is needed on the attacker side (PR:N). The flaw affects BA Book Everything versions 1.8.33 and earlier. The precise feature, parameter, or endpoint carrying the unsanitized input is not described in the available sources, so the exact trigger cannot be stated with certainty; the primary limiting factor is the mandatory user-interaction requirement, which prevents fully automated, unattended exploitation.

This is a moderate-severity, unauthenticated reflected-style Cross-Site Scripting flaw (CWE-79) in the BA Book Everything WordPress plugin, scored CVSS 7.1 by the reporting source. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation with no privileges required, but it explicitly depends on user interaction (UI:R) - a victim must be induced to trigger the payload, which is the single largest limiting factor. The scope change (S:C) reflects that injected script executes in the victim's browser context rather than the vulnerable backend, consistent with XSS. There is no CISA KEV listing, so this is NOT confirmed actively exploited; no EPSS score was supplied in the input, so exploitation probability cannot be quantified here; and no public exploit identified at time of analysis. The vuln.today priority is 'this_week' (not act_now/emergency), aligning with a patch-promptly-but-not-drop-everything posture. Net: a genuine issue worth remediating on a normal weekly cycle, but the mandatory user-interaction requirement and absence of KEV/known exploitation keep this below drop-everything urgency; the elevated 7.1 is driven largely by the scope-change scoring rather than confirmed mass exploitability.

An attacker crafts a malicious URL or form input targeting an unsanitized parameter in the BA Book Everything plugin and lures a site visitor or administrator into clicking it. When the victim's browser renders the reflected response, attacker-controlled JavaScript executes in the context of the WordPress site, enabling session/cookie theft, actions on behalf of the victim, or defacement. No public exploit was identified at time of analysis, and the specific injectable parameter is not described in the available sources.