CVE-2026-108487: WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability
Published Oct 13, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak Books Gallery wp-books-gallery allows Stored XSS.This issue affects Books Gallery: from n/a through 4.8.4.
Affected Software
1 affected component
Hossni Mubarak Books Gallery<=4.8.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wp-books-galleryto a version that resolves this vulnerability.Fixed in 4.8.5
Event History
Oct 13, 2026
CVE Published
via MITRE·08:51 AM
Data Sourced
via MITRE·08:51 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The CVSS vector indicates network access, low attack complexity, and low-level privileges are required. Exploitation also requires user interaction.
2
Is a fixed version identified in the available information?
No fixed version is identified in the supplied data. The affected range is listed as through version 4.8.4, with no lower bound specified.