CVE-2026-108498: WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability

Q: Does exploitation require an authenticated account?

No. The vulnerability is rated with no privileges required, so an attacker does not need an authenticated account. Exploitation does require user interaction.

Q: What is the expected impact if exploitation succeeds?

The CVSS vector indicates low impacts to confidentiality, integrity, and availability. The scope is changed, meaning the impact can extend beyond the vulnerable component's security authority.

Q: Which installations are affected?

BSK PDF Manager versions through 3.8.1 are affected. The provided data does not identify a fixed version.

Published Oct 15, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.

Affected Software

1 affected component

BannerSky BSK PDF Manager<=3.8.1

Event History

Oct 15, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an authenticated account?

No. The vulnerability is rated with no privileges required, so an attacker does not need an authenticated account. Exploitation does require user interaction.

What is the expected impact if exploitation succeeds?

The CVSS vector indicates low impacts to confidentiality, integrity, and availability. The scope is changed, meaning the impact can extend beyond the vulnerable component's security authority.

Which installations are affected?