Bannersky BSK PDF Manager vulnerabilities

7 vulnerabilities

Known vulnerabilities in Bannersky BSK PDF Manager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.1CVE-2026-108498bannerskybsk pdf manager
EPSS score
0.15%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.7.2CVE-2021-24860bannerskybsk pdf manager+2
EPSS score
1.32%
The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue5.5CVE-2025-4970bannerskybsk pdf manager+1
EPSS score
0.30%
The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. This only affects multi-site installations and installations where unfiltered_html has been disabled.9.9CVE-2014-4944bannerskybsk pdf manager+1
EPSS score
3.55%
Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) categoryid or (2) pdfid parameter to wp-admin/admin.php.6.5CVE-2026-65528bannerskybsk pdf manager+1
EPSS score
0.22%
Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.5.3CVE-2026-39686bannerskybsk pdf manager+1
EPSS score
0.31%
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Retrieve Embedded Sensitive Data.This issue affects BSK PDF Manager: from n/a through <= 3.7.2.6.4CVE-2023-5110bannerskybsk pdf manager+1
EPSS score
0.45%
The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' shortcode in versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.