3D FlipBook < 1.12.1 - Subscriber+ Stored Cross-Site Scripting

The plugin does not have authorisation and CSRF checks when updating its settings, and does not have any sanitisation/escaping, allowing any authenticated users, such as subscriber to put Cross-Site Scripting payloads in all pages with a 3d flipbook. PoC As a subscriber:...

WordPress Unreal FlipBook plugin <= 1.12.0 - Subscriber+ Stored Cross-Site Scripting (XSS) vulnerability

Subscriber+ Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Unreal FlipBook plugin versions = 1.12.0. Solution Update the WordPress Unreal FlipBook plugin to the latest available version at least 1.12.1...

WordPress 3D FlipBook plugin <= 1.12.0 - Subscriber+ Stored Cross-Site Scripting (XSS) vulnerability

Subscriber+ Stored Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress 3D FlipBook plugin versions = 1.12.0. Solution Update the WordPress 3D FlipBook plugin to the latest available version at least 1.12.1...

CVE-2021-24732

The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

CVE-2021-24732

The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

Cross site scripting

The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

CVE-2021-24732 Dflip Lite < 1.7.10 - Contributor+ Stored Cross-Site Scripting

The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

CVE-2021-24732

The CVE concerns the DearFlip (Dflip Lite) WordPress plugin, prior to version 1.7.10. The vulnerability arises from not escaping the class attribute of the plugin’s shortcode before outputting it in an attribute, enabling Stored Cross-Site Scripting by users with as low as Contributor privileges....

WordPress 插件跨站脚本漏洞

WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in WordPress PDF Flipbook, 3D Flipbook, DearFlip plugin versions prior to 1.7.10, which stems from not bypassing the class attribute of its shortcode before outputting back to the attribut...

WordPress iPages Flipbook plugin <= 1.4.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress iPages Flipbook plugin versions = 1.4.2. Solution Update the WordPress iPages Flipbook plugin to the latest available version at least 1.4.3...

Multiple vulnerabilities in extension "Magalone Flipbook for TYPO3" (magaloneflipbook)

An authenticated backend user can use the backend module to upload arbitrary files resulting in Remote Code Execution. Also, the backend module is susceptible to path traversal which allows an authenticated backend user to upload and overwrite files in all locations the webserver has access to...

CVE-2016-10967

The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter...

CVE-2016-10965

The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion...

CVE-2016-10966

The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload...

CVE-2016-10965

The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion...

CVE-2016-10967

The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter...

CVE-2016-10967

The CVE-2016-10967 entry concerns the WordPress plugin real3d-flipbook-lite (v1.0) . The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via the parameter bookId in the file path wp-content/plugins/real3d-flipbook/includes/flipbooks.php . Root cause is inadequate input handling/san...

CVE-2016-10966

The CVE-2016-10966 entry concerns the WordPress plugin real3d-flipbook-lite version 1.0. The vulnerability is a directory traversal in the file upload process via bookName=../, enabling traversal beyond the intended directory. Details across connected documents confirm the affected product and th...

CVE-2016-10965

The CVE-2016-10965 entry concerns the real3d-flipbook-lite plugin for WordPress (version 1.0). The underlying issue is a deleteBook=../ directory traversal vulnerability that enables traversal for file deletion. Connected sources confirm the affected software and the root cause (directory travers...

CVE-2016-10965: Improper Limitation of a Pathname to a Restricted Directory

The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion...