CVE-2026-109895: WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Booktics pluginto a version that resolves this vulnerability.Fixed in 1.0.30
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker can attempt exploitation remotely without authentication, but successful exploitation requires a victim to interact with attacker-controlled content or a crafted page, as indicated by the user-interaction requirement.
What is the potential impact if exploitation succeeds?
Successful exploitation can affect confidentiality, integrity, and availability to a low extent. The impact scope can extend beyond the vulnerable Booktics plugin component.
Which Booktics versions are affected?
Booktics versions through 1.0.29 are affected. The available data does not identify a fixed version.