Books Gallery
Monthly
Unauthenticated SQL injection in the WordPress Books Gallery plugin (wp-books-gallery) 4.8.3 and earlier lets a remote attacker read arbitrary data from the site's WordPress database over plain HTTP, with no credentials and no user interaction required. Exposure is limited to sites that actually have this low-adoption plugin installed and activated, and no public exploit code was identified at time of analysis; there is no CISA KEV entry for this issue. Because the assessed impact is high confidentiality with only a low availability effect, the realistic worst case is full database disclosure - user password hashes, private content and configuration secrets - rather than code execution or data tampering.
Stored cross-site scripting in the WordPress 'Books Gallery' plugin (wp-books-gallery) affects all releases through 4.8.4, allowing an attacker to persist malicious JavaScript that executes in the browser of whoever later views the affected page. Per our assessment, exploitation requires an authenticated WordPress account with at least low-level posting privileges (CVSS vector PR:L) plus victim interaction (UI:R) - a privileged user or site visitor must load the page where the injected payload is rendered - so this is not remotely exploitable without credentials, and real-world risk is materially constrained by those prerequisites. Rated CVSS 6.5 by Patchstack and mapped to CWE-79, this is a moderate-severity issue with no public exploit identified at time of analysis and no CISA KEV listing; exposure is confined to WordPress sites running the Books Gallery plugin at version 4.8.4 or earlier.
Unauthenticated SQL injection in the WordPress Books Gallery plugin (wp-books-gallery) 4.8.3 and earlier lets a remote attacker read arbitrary data from the site's WordPress database over plain HTTP, with no credentials and no user interaction required. Exposure is limited to sites that actually have this low-adoption plugin installed and activated, and no public exploit code was identified at time of analysis; there is no CISA KEV entry for this issue. Because the assessed impact is high confidentiality with only a low availability effect, the realistic worst case is full database disclosure - user password hashes, private content and configuration secrets - rather than code execution or data tampering.
Stored cross-site scripting in the WordPress 'Books Gallery' plugin (wp-books-gallery) affects all releases through 4.8.4, allowing an attacker to persist malicious JavaScript that executes in the browser of whoever later views the affected page. Per our assessment, exploitation requires an authenticated WordPress account with at least low-level posting privileges (CVSS vector PR:L) plus victim interaction (UI:R) - a privileged user or site visitor must load the page where the injected payload is rendered - so this is not remotely exploitable without credentials, and real-world risk is materially constrained by those prerequisites. Rated CVSS 6.5 by Patchstack and mapped to CWE-79, this is a moderate-severity issue with no public exploit identified at time of analysis and no CISA KEV listing; exposure is confined to WordPress sites running the Books Gallery plugin at version 4.8.4 or earlier.