CVE-2026-39604
Stored XSS in MyBookTable Bookstore Allows Persistent Script Injection
Publication date: 2026-04-08
Last updated on: 2026-04-13
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zookatron | mybooktable | to 3.6.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the Cross-site Scripting (XSS) vulnerability in MyBookTable Bookstore Plugin affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-39604 is a Cross Site Scripting (XSS) vulnerability found in the WordPress MyBookTable Bookstore Plugin versions up to and including 3.6.0.
This vulnerability allows an attacker to inject malicious scripts, such as redirects, advertisements, or other HTML payloads, which execute when visitors access the affected website.
Exploitation requires user interaction by a privileged user (for example, someone with author or developer roles) who performs actions like clicking a malicious link, visiting a crafted page, or submitting a form.
The vulnerability is classified as low priority with a CVSS score of 5.9 and falls under the OWASP Top 10 category A3: Injection.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts on your website, which could lead to unwanted redirects, display of unauthorized advertisements, or other harmful HTML payloads.
Such script execution can compromise the integrity and trustworthiness of your website and potentially affect your users' experience.
However, exploitation is considered unlikely because it requires interaction by a privileged user.
No official patch is currently available, so it is recommended to update the plugin when possible or seek assistance from hosting providers or developers to mitigate risks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a Stored Cross Site Scripting (XSS) issue in the MyBookTable Bookstore Plugin up to version 3.6.0. Detection typically involves identifying malicious script injections in web page inputs or stored content.
Since exploitation requires user interaction by privileged users (such as authors or developers) submitting crafted inputs, detection can include monitoring for unusual or suspicious input submissions or unexpected script tags in stored data.
Specific commands are not provided in the available resources. However, general detection methods for XSS vulnerabilities include using web vulnerability scanners or manual inspection of input fields and stored content for injected scripts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the MyBookTable Bookstore Plugin to a version later than 3.6.0 if available.
Since no official patch is currently available, it is recommended to seek assistance from hosting providers or developers to implement temporary fixes or workarounds.
Additionally, restricting privileged user interactions and carefully validating or sanitizing inputs can reduce the risk of exploitation.