EUVD-2026-48129
GHSA-rjmc-wgvp-8jjg
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
AV:N and PR:L confirmed by web-based contributor-role attack; A:N because XSS does not cause system availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
AnalysisAI
Stored Cross-Site Scripting in the BSK PDF Manager WordPress plugin version 3.8 and earlier allows authenticated contributors to inject persistent malicious JavaScript into plugin-managed content. Because the CVSS vector reflects a scope change (S:C), the injected script executes in the security context of higher-privileged users - most critically WordPress administrators - who later view the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis, but the contributor-to-admin privilege escalation path makes this a meaningful risk for multi-author WordPress installations.
Technical ContextAI
BSK PDF Manager is a WordPress plugin developed by BannerSky (CPE: cpe:2.3:a:bannersky:bsk_pdf_manager:*:*:*:*:*:*:*:*) that allows site editors to manage and display PDF documents. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that user-supplied input from a Contributor-role account is not properly sanitized or encoded before being rendered as HTML in the browser. The root cause is the failure to apply output encoding to plugin-specific fields editable by contributors, permitting HTML/JavaScript injection that persists in the database and is later served to unsuspecting users. The CVSS scope-change metric (S:C) confirms the attack crosses the trust boundary from the contributor's own session into that of other authenticated users.
RemediationAI
Update BSK PDF Manager to a version beyond 3.8 once a patched release is published by BannerSky; monitor the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/bsk-pdf-manager/vulnerability/wordpress-bsk-pdf-manager-plugin-3-8-cross-site-scripting-xss-vulnerability for patch availability. An exact fixed version number was not independently confirmed in the available data - do not assume any specific version is safe without vendor confirmation. As an interim compensating control, restrict the WordPress Contributor role to fully trusted users only, since exploitation requires that role; removing contributor-level access entirely eliminates the attack surface until a patch is applied. Additionally, deploying a Web Application Firewall rule targeting reflected or stored XSS patterns in WordPress plugin endpoints can reduce exploitation likelihood, though WAF rules are not a substitute for patching. Monitoring WordPress admin session tokens for anomalous reuse can serve as a detection control.
More in Bsk Pdf Manager
View allThe BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before u
Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress al
The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' s
BSK PDF Manager WordPress plugin versions through 3.7.2 expose embedded sensitive data to unauthenticated remote actors
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today