Mybooktable Vulnerabilities

The MyBookTable Bookstore plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages...

CVSS:

6.4

Affected:

up to 3.6.0

Fix:

No patched version reported

Disclosed:

Feb 1, 2026

CVE-2026-39604 on NVD →

The MyBookTable Bookstore plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in...

CVSS:

6.4

Affected:

up to 3.5.6

Fix:

No patched version reported

Disclosed:

Dec 31, 2025

CVE-2025-62743 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore allows Stored XSS.This issue affects MyBookTable Bookstore: from n/a through 3.5.5.

Affected:

up to 3.5.5

Fix:

No patched version reported

Disclosed:

Dec 31, 2025

CVE-2025-62743 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Stormhill Media MyBookTable Bookstore allows Cross Site Request Forgery.This issue affects MyBookTable Bookstore: from n/a through 3.5.3.

Affected:

up to 3.5.4

Fixed in:

3.5.4

Disclosed:

Jan 7, 2025

CVE-2025-22301 on NVD →

The MyBookTable Bookstore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect nonce validation on the mbt_add_admin_notices() function. This makes it possible for unauthenticated attackers to add the plugin's pages via a forged re...

CVSS:

4.3

Affected:

up to 3.5.3

Fixed in:

3.5.4

Disclosed:

Jan 6, 2025

CVE-2025-22301 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Stormhill Media MyBookTable Bookstore allows Cross-Site Scripting (XSS).This issue affects MyBookTable Bookstore: from n/a through 3.3.9.

Affected:

up to 3.5.0

Fixed in:

3.5.0

Disclosed:

Aug 26, 2024

CVE-2024-43255 on NVD →

The MyBookTable Bookstore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.0. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to update plugin settings and inject malicious web scripts v...

CVSS:

6.1

Affected:

up to 3.4.0

Fixed in:

3.5.0

Disclosed:

Aug 12, 2024

CVE-2024-43255 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stormhill Media MyBookTable Bookstore allows Stored XSS.This issue affects MyBookTable Bookstore: from n/a through 3.3.7.

Affected:

up to 3.3.8

Fixed in:

3.3.8

Disclosed:

Mar 27, 2024

CVE-2024-29772 on NVD →

The MyBookTable Bookstore plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SEO post data in versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary we...

CVSS:

6.4

Affected:

up to 3.3.7

Fixed in:

3.3.8

Disclosed:

Mar 25, 2024

CVE-2024-29772 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Stormhill Media MyBookTable Bookstore by Stormhill Media allows Cross Site Request Forgery.This issue affects MyBookTable Bookstore by Stormhill Media: from n/a through 3.3.4.

Affected:

up to 3.3.5

Fixed in:

3.3.5

Disclosed:

Nov 30, 2023

CVE-2023-48331 on NVD →

The MyBookTable Bookstore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.3. This is due to missing or incorrect nonce validation on the mbt_api_key_refresh_ajax() function. This makes it possible for unauthenticated attackers to update the API key via a forged req...

CVSS:

4.3

Affected:

up to 3.3.3

Fixed in:

3.3.4

Disclosed:

Nov 23, 2023

CVE-2023-48331 on NVD →

Multiple Cross-Site Scripting (XSS) vulnerabilities found in WordPress MyBookTable plugin (versions <= 3.2.2).

Affected:

up to 3.2.3

Fixed in:

3.2.3

Disclosed:

Jul 5, 2019

The MyBookTable Bookstore plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser if th...

CVSS:

7.2

Affected:

up to 3.2.2

Fixed in:

3.2.3

Disclosed:

Jul 3, 2019

The MyBookTable Bookstore plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser if th...

Affected:

up to 3.2.3

Fixed in:

3.2.3

Disclosed:

Jul 3, 2019

The MyBookTable Bookstore by Stormhill Media plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including 2.1.4, due to insufficient input sanitization and output escaping in the shadowbox feature.

CVSS:

6.4

Affected:

up to 2.1.4

Fixed in:

2.1.5

Disclosed:

Sep 21, 2015

The MyBookTable Bookstore by Stormhill Media plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including 2.1.4, due to insufficient input sanitization and output escaping in the shadowbox feature.

Affected:

up to 2.1.5

Fixed in:

2.1.5

Disclosed:

Sep 21, 2015

The MyBookTable Bookstore by Author Media WordPress plugin was affected by an Unspecified Vulnerability security vulnerability.

Affected:

up to 2.1.5

Fixed in:

2.1.5

Version &lt;= 3.2.1 contains multiple XSS in various locations due to not escaping user&#039;s input before output it, example: https://&lt;BLOG&gt;/wp-admin/admin.php?page=mbt_help&amp;mbt_video_tutorial=&quot;&gt;&lt;svg/onload=alert(/XSS/)&gt; WPScan Team: v3.2.2 implemented numerous sanitisation improvements,...

Affected:

up to 3.2.3

Fixed in:

3.2.3