Description

The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-23T06:17:00.710Z",
  "pubdate": "2026-09-23T06:17:00.710Z",
  "executiveSummary": "The Real3D Flipbook WordPress plugin, in versions prior to 5.4, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThe flaw originates from inadequate input validation and output encoding within the flipbook editor interface.\nAttackers with Author-level privileges or higher can inject malicious JavaScript payloads into specific editor fields, which are subsequently rendered in the administrative dashboard.\nWhen an administrator or authorized user accesses the affected flipbook, the stored script executes within the context of their active session.\nThis allows for potential administrative account takeover, unauthorized actions performed on behalf of the victim, or sensitive data exfiltration.\nThe vulnerability represents a significant risk to site integrity and security, as it allows low-privileged users to escalate their impact by targeting high-privileged administrative users.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), stemming from the failure of the Real3D Flipbook plugin to sanitize or escape user-supplied data before it is rendered within the flipbook editor.\nAffected versions include all iterations prior to version 5.4. The scope of the vulnerability is localized to the plugin's internal administration dashboard where flipbook configurations are managed.\nThe attack vector requires the attacker to possess authenticated access to the WordPress dashboard with at least the Author role. An attacker navigates to the flipbook editor and injects a malicious payload into fields that lack server-side sanitization or client-side output encoding.\nBecause the plugin does not properly handle these inputs, the malicious script is stored in the WordPress database alongside the flipbook configuration settings.\nThe exploitation flow proceeds as follows: First, the attacker saves a crafted payload within an insecure editor field. Second, when an administrator or higher-privileged user subsequently opens the compromised flipbook configuration for editing, the plugin retrieves the stored data from the database and embeds the raw, unescaped payload into the administrative web page.\nThe browser of the victimized user renders the injected payload, executing the JavaScript in the context of their authenticated session. This allows the script to interact with the DOM, access session cookies, or perform administrative actions via AJAX calls to the WordPress REST API or admin-ajax.php, all without the victim's knowledge.\nSince the payload is executed within the administrative backend, the scope of impact is highly elevated. An attacker could potentially create new administrative accounts, modify plugin settings, or redirect traffic. The lack of proper output sanitization constitutes the root cause, transforming a standard data entry field into an injection vector for malicious web scripts."
}