PT-2025-43052 · WordPress · Bg Book Publisher

Published 2025-10-22 · Updated 2025-10-22 · CVE-2025-11867

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bg Book Publisher versions prior to 1.26

Description The Bg Book Publisher plugin for WordPress is susceptible to Stored Cross-Site Scripting through the book author post meta, which is rendered using the [book author] shortcode. The plugin does not properly sanitize the meta value before displaying it, allowing authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. These scripts will execute when a user views the affected page.

Recommendations Update Bg Book Publisher to version 1.26 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-11867

Affected Products

Bg Book Publisher

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-11867 · Security Note
• https://plugins.trac.wordpress.org/browser/bg-book-publisher/tags/1.25/bg_bpub.php#L121 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/af181085-0a6b-4e87-b250-1fb4574d808d?source=cve · Note
• https://t.me/cveNotify/139827 · Telegram Post
• https://t.me/CVEtracker/35473 · Telegram Post