iPages Flipbook < 1.5.0 - Authenticated (Administrator+) SQL Injection

Description The iPages Flipbook For WordPress plugin for WordPress is vulnerable to SQL Injection via the orderby parameter in all versions up to 1.5.0 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

WordPress iPages Flipbook Plugin <= 1.4.8 is vulnerable to SQL Injection

Software iPages Flipbook Type Plugin Vulnerable versions = 1.4.8 Fixed in 1.5.0 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-47236 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID ca6f53544a70 Credits Muhammad Daffa Required privilege Administrator...

CVE-2023-5200

The flowpaper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'flipbook' shortcode in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2022-4453

The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like...

Cross site scripting

The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like...

CVE-2022-4453 3D FlipBook <= 1.13.2 - Contributor+ Stored XSS

The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like...

CVE-2022-4453 3D FlipBook <= 1.13.2 - Contributor+ Stored XSS

The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like...

CVE-2022-4453

The CVE-2022-4453 issue affects the WordPress plugin 3D FlipBook up to version 1.13.2 (and earlier). The vulnerability arises from not validating/escaping certain shortcode attributes before output, enabling Stored XSS where a user with as little as Contributor privileges can target high-privileg...

WordPress plugin 3D FlipBook 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2023-14495 · WordPress · 3D Flipbook Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: 3D FlipBook WordPress plugin versions 1.13.2 and earlier Description: The issue concerns the 3D FlipBook WordPress plugin, which does not validate or escape some of its shortcode attributes before outputting them back in the page. This could...

CVE-2022-4394

The iPages Flipbook For WordPress plugin through 1.4.6 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-4394

The iPages Flipbook For WordPress plugin through 1.4.6 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The iPages Flipbook For WordPress plugin through 1.4.6 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-4394

The CVE-2022-4394 vulnerability affects the iPages Flipbook For WordPress plugin (versions up to 1.4.6, prior to 1.4.7 per some sources) where settings are not properly sanitized/escaped. This enables Stored Cross-Site Scripting by low-privilege users (e.g., Contributor+) even when unfiltered_htm...

CVE-2022-4394 iPages Flipbook For WordPress <= 1.4.6 - Contributor+ Stored XSS

The iPages Flipbook For WordPress plugin through 1.4.6 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-4394 iPages Flipbook For WordPress <= 1.4.6 - Contributor+ Stored XSS

The iPages Flipbook For WordPress plugin through 1.4.6 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2023-14406 · WordPress · Ipages Flipbook For Wordpress

Name of the Vulnerable Software and Affected Versions: iPages Flipbook For WordPress plugin versions 1.4.6 and earlier Description: The issue allows users, such as those with contributor+ roles, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly...

WordPress Plugin iPages Flipbook For WordPress 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

3D FlipBook < 1.13.3 - Contributor+ Stored XSS

The plugin does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like administrators. 1. As an administrator, creat...

iPages Flipbook For WordPress < 1.4.7 - Contributor+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC 1. Create a new book item with whatever role, even if it's an Administrator. 2...