Cross-site Scripting Vulnerability in Arraytics Booktics Plugin
CVE-2026-109895

7.1HIGH

Key Information:

Vendor

WordPress
Status
Booktics
Vendor
CVE Published:
18 October 2026

What is CVE-2026-109895?

A Cross-site Scripting (XSS) vulnerability has been identified in the Arraytics Booktics plugin, allowing attackers to inject malicious scripts into the application's web pages. This issue can lead to unintended interactions with users' browsers, potentially compromising sensitive information and user sessions. Users of Booktics versions from n/a to 1.0.29 are particularly at risk. To safeguard your site, it's essential to implement patches or updates and ensure that proper input validation measures are in place.

Affected Version(s)

Booktics 0 <= 1.0.29

References

https://patchstack.com/database/wordpress/plugin/booktics...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dzaku | Patchstack Bug Bounty Program
.