Description

The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute (and other unsanitized attributes handled by on_shortcode()) in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping in the on_shortcode() and print_global_options() functions: shortcode attribute values are copied verbatim into $this->flipbook_options and then emitted via wp_json_encode() inside a <script type="application/json"> block without the JSON_HEX_TAG flag, allowing a literal </script> byte sequence in the attribute value to break out of the JSON script context. Because WordPress's shortcode_parse_atts() applies stripcslashes() to attribute values, an attacker can encode the breakout tag as \x3c/script\x3e\x3cscript\x3e…\x3c/script\x3e, which survives the wp_kses_post save-time filter applied to Contributor content (the escape bytes are safe text characters, not HTML tags) and is decoded to real angle brackets at render time. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user (typically an Editor or Administrator previewing/moderating the pending post) accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-19T08:16:52.487Z",
  "pubdate": "2026-09-19T08:16:52.487Z",
  "executiveSummary": "The Real3D Flipbook Lite plugin for WordPress (versions 5.1.1 and below) is vulnerable to Stored Cross-Site Scripting (XSS).\nThis vulnerability exists due to improper input sanitization and inadequate output escaping within the plugin's shortcode handling mechanisms.\nThe flaw allows authenticated users with Contributor-level access or higher to inject malicious JavaScript payloads into WordPress posts.\nWhen a privileged user, such as an Administrator or Editor, previews or views a page containing the manipulated shortcode, the injected script executes within the context of their session.\nThis can lead to unauthorized actions performed on behalf of the victim, session hijacking, or site-wide administrative compromise.\nThe issue is particularly critical as the bypass mechanism circumvents standard save-time filters like wp_kses_post, making detection and prevention challenging without a patch.\nThe vulnerability necessitates immediate remediation, as the attack vector requires only standard authenticated user access.",
  "technicalDetails": "The vulnerability resides in the handling of shortcode attributes within the Real3D Flipbook Lite plugin, specifically inside the on_shortcode() and print_global_options() functions.\nShortcode attributes, such as 'lightboxtext', are processed and stored into the $this->flipbook_options object without adequate sanitization or validation.\nWhen the plugin renders these options, it utilizes wp_json_encode() to output the data into a <script type='application/json'> block. Crucially, the function fails to utilize the JSON_HEX_TAG flag, which would encode character sequences that could terminate an HTML script block.\nBecause WordPress's shortcode_parse_atts() function applies stripcslashes() during the parsing process, an attacker can manipulate the input to bypass security filters. By crafting an attribute value containing escaped characters like \\x3c/script\\x3e\\x3cscript\\x3e, the payload successfully evades save-time filters like wp_kses_post, which incorrectly identifies the input as safe text rather than executable HTML.\nUpon rendering, these escaped sequences are decoded back into literal angle brackets, effectively closing the legitimate JSON script block and injecting arbitrary HTML/JavaScript tags.\nThe exploitation flow is as follows: 1) An authenticated attacker with Contributor-level privileges creates or edits a post containing the Real3D Flipbook shortcode with a malicious 'lightboxtext' attribute. 2) The plugin saves the payload to the database, bypassing sanitation filters. 3) A privileged user accesses the post (e.g., via the WordPress admin preview function). 4) The plugin renders the malicious script content within the application/json block, where the injected tags break out of the script context and execute within the victim's browser session.\nThe successful execution of this payload allows for the full compromise of the victim's authenticated session, potentially granting an attacker full control over the WordPress installation."
}