PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39604 zookatron CVE debrief

CVE-2026-39604 is a Stored Cross-site Scripting (XSS) vulnerability in the MyBookTable Bookstore plugin for WordPress. This issue, affecting versions from n/a through 3.6.0, allows an attacker to inject malicious scripts into web pages, potentially leading to unauthorized actions or data exposure. Users of the MyBookTable Bookstore plugin should review and update their installations to mitigate this risk.

Vendor
zookatron
Product
MyBookTable Bookstore
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Administrators and users of the MyBookTable Bookstore plugin for WordPress should be aware of this vulnerability and take steps to protect their installations. This includes reviewing the plugin's version and updating to a patched version if necessary.

Technical summary

The MyBookTable Bookstore plugin for WordPress is vulnerable to Stored Cross-site Scripting (XSS). This occurs because the plugin does not properly neutralize input during web page generation. An attacker could exploit this by injecting malicious scripts, potentially leading to unauthorized actions or data exposure. The vulnerability has been assigned a CVSS score of 5.9, indicating a medium severity level.

Defensive priority

Medium priority due to potential for unauthorized actions or data exposure.

Recommended defensive actions

  • Review and update the MyBookTable Bookstore plugin to a version beyond 3.6.0 if possible.
  • Implement additional monitoring for suspicious activity on affected installations.
  • Consider applying compensating controls such as Web Application Firewalls (WAFs) to detect and prevent XSS attacks.

Evidence notes

The CVE record was published on 2026-04-08T09:16:29.610Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Deferred. Patchstack reported this vulnerability, providing details on the affected plugin and version range.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-39604 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-39604

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-39604 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-39604

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.