Unauthenticated Cross Site Scripting in BA Book Everything Plugin for WordPress
CVE-2026-39786

7.1HIGH

Key Information:

Vendor

WordPress
Status
Ba Book Everything
Vendor
CVE Published:
30 October 2026

What is CVE-2026-39786?

A security flaw exists in the BA Book Everything plugin for WordPress that allows unauthenticated users to exploit cross site scripting (XSS), potentially injecting malicious scripts into the web pages viewed by other users. This vulnerability affects versions 1.8.33 and prior, enabling attackers to manipulate content and perform actions that could compromise user data and site integrity.

Affected Version(s)

BA Book Everything <= 1.8.33

References

https://patchstack.com/database/wordpress/plugin/ba-book-...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AndrewN | Patchstack Bug Bounty Program
.