CVE-2026-101111 MEDIUM

CVE-2026-101111: Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6

Vendor Ordasoft.com
Product Book Library (Free) extension for Joomla
Weakness CWE-79 · XSS
Published September 28, 2026
Last update September 30, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind (echo $_REQUEST["title"];). A value containing a double quote closes the attribute early and allows arbitrary HTML/JavaScript to follow.

Key dates

02Disclosure timeline

September 28, 2026 CVE published
September 30, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-78273 WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability CVE-2026-81778 WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability CVE-2026-75964 User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter CVE-2026-18512 TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor CVE-2026-78281 WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability