BSK PDF Manager vulnerabilities

The BSK PDF Manager WordPress plugin up to version 3.8.1 does not properly neutralize input during web page generation, allowing Stored XSS. A malicious script stored in the application is later executed in other users' browsers.

The BSK PDF Manager plugin versions up to 3.8 contain a Cross Site Scripting (XSS) vulnerability exploitable by contributors. A contributor can inject malicious JavaScript code.

The BSK PDF Manager plugin for WordPress (versions up to 3.7.2) exposes sensitive system information to unauthorized entities, allowing retrieval of embedded sensitive data.

The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to and including 3.7.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Administrator-level access and above to inject arbitrary web scripts that execute when a user accesses the SVG file. This only affects multi-site installations and installations where unfiltered_html has been disabled.