This vulnerability (CVE-2026-65528) is classified as CWE-79, indicating improper neutralization of input leading to Cross-Site Scripting (XSS) in bannersky BSK PDF Manager versions up to 3.8. The CVSS 3.1 base score is 6.5 (medium), with attack vector network, low attack complexity, requiring low privileges and user interaction, and impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with contributor-level privileges to inject malicious scripts that execute in the context of other users, potentially leading to limited data disclosure, modification, or disruption of service within the affected application. The impact is limited by the requirement for user interaction and low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor privileges where possible and educate users about the risks of interacting with untrusted content. Monitor vendor communications for updates on patches or official mitigations.