PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39604 zookatron CVE debrief

CVE-2026-39604 is a Stored Cross-site Scripting (XSS) vulnerability in the MyBookTable Bookstore plugin for WordPress. This issue, affecting versions from n/a through 3.6.0, allows an attacker to inject malicious scripts into web pages, potentially leading to unauthorized actions or data exposure. Users of the MyBookTable Bookstore plugin should review and update their installations to mitigate this risk.

Vendor
zookatron
Product
MyBookTable Bookstore
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Administrators and users of the MyBookTable Bookstore plugin for WordPress should be aware of this vulnerability and take steps to protect their installations. This includes reviewing the plugin's version and updating to a patched version if necessary.

Technical summary

The MyBookTable Bookstore plugin for WordPress is vulnerable to Stored Cross-site Scripting (XSS). This occurs because the plugin does not properly neutralize input during web page generation. An attacker could exploit this by injecting malicious scripts, potentially leading to unauthorized actions or data exposure. The vulnerability has been assigned a CVSS score of 5.9, indicating a medium severity level.

Defensive priority

Medium priority due to potential for unauthorized actions or data exposure.

Recommended defensive actions

  • Review and update the MyBookTable Bookstore plugin to a version beyond 3.6.0 if possible.
  • Implement additional monitoring for suspicious activity on affected installations.
  • Consider applying compensating controls such as Web Application Firewalls (WAFs) to detect and prevent XSS attacks.

Evidence notes

The CVE record was published on 2026-04-08T09:16:29.610Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Deferred. Patchstack reported this vulnerability, providing details on the affected plugin and version range.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T09:16:29.610Z and has not been modified since then. The NVD entry is currently Deferred.