Stored Cross-Site Scripting Vulnerability in Bg Book Publisher Plugin for WordPress

CVE-2025-11867

What is CVE-2025-11867?

The Bg Book Publisher plugin for WordPress poses a threat due to a Stored Cross-Site Scripting vulnerability. When the book_author post meta is rendered through the [book_author] shortcode, it can be exploited by authenticated attackers with contributor-level access. The plugin fails to adequately escape the meta value before outputting it, which allows malicious scripts to be injected into pages. Consequently, these scripts will execute when a user visits any modified page, potentially compromising user data and site integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References