Stored Cross-Site Scripting Vulnerability in Bg Book Publisher Plugin for WordPress

CVE-2025-11867

What is CVE-2025-11867?

The Bg Book Publisher plugin for WordPress poses a threat due to a Stored Cross-Site Scripting vulnerability. When the book_author post meta is rendered through the [book_author] shortcode, it can be exploited by authenticated attackers with contributor-level access. The plugin fails to adequately escape the meta value before outputting it, which allows malicious scripts to be injected into pages. Consequently, these scripts will execute when a user visits any modified page, potentially compromising user data and site integrity.

References