CVE-2026-96822

CriticalCVSS 9.3

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

The Books Gallery plugin in versions up to and including 4.8.3 contains an unauthenticated SQL injection vulnerability. An attacker can execute malicious SQL queries without logging in.

Risk Assessment

This may allow unauthorized database access, data leakage, or modification, posing a serious security threat.

Recommendation

Update the Books Gallery plugin to a version newer than 4.8.3 that fixes this vulnerability.

Other vulnerabilities in Books Gallery

CVE-2026-108487Medium
The Books Gallery plugin up to version 4.8.4 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.

Original NVD description (English source)

Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS