CVE-2026-101111
Received Received - Intake

Reflected XSS in Joomla Book Library Extension

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Joomla! Project

Description
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind (echo $_REQUEST["title"];). A value containing a double quote closes the attribute early and allows arbitrary HTML/JavaScript to follow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101111
EUVD
EUVD-2026-88439

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ordasoft book_library to 6.4.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in the Joomla Book Library (Free) extension by ordasoft.com. The issue occurs in the book-detail page template where the raw title request parameter is echoed without proper escaping into an HTML attribute. This allows attackers to inject malicious scripts by crafting a URL with a specially formatted title parameter.

Detection Guidance

Check if the Joomla Book Library (Free) extension version is below 6.4.6. Inspect the site/views/view_book/tmpl/default.php file for the presence of the vulnerable echo $_REQUEST['title']; statement without proper escaping.

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in a victim's browser when they visit a maliciously crafted link. This could lead to session hijacking, defacement of the website, or theft of sensitive user data like cookies or credentials.

Compliance Impact

This vulnerability allows arbitrary JavaScript execution via reflected XSS, which could enable attackers to steal session cookies or sensitive data. This may violate GDPR's requirement for protecting personal data integrity and confidentiality, and HIPAA's safeguards for electronic protected health information if exploited in healthcare contexts.

Mitigation Strategies

Update the Book Library (Free) extension to version 6.4.6 or higher. If an update is not available, remove or disable the extension immediately. Apply input validation and output escaping to the title parameter in the default.php template.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101111. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart