48 matches found
CVE-2026-86842
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...
CVE-2025-15696
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the...
CVE-2026-86842 Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...
EUVD-2026-85046
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...
CVE-2026-86842
The Real3D Flipbook WordPress plugin (versions before 5.4 ) is vulnerable to a broken access control issue because it fails to perform adequate capability checks on several authenticated flipbook management actions. This allows users with Author-level access and above to delete flipbook content b...
WordPress Real3D Flipbook plugin < 5.4 - Author+ Content Deletion and Stored XSS vulnerability
Author+ Content Deletion and Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Real 3D FlipBook versions 5.4...
CVE-2026-86842 Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...
WordPress Real3D Flipbook plugin < 5.4 - Author+ Stored XSS vulnerability
Author+ Stored XSS vulnerability discovered by Hanif Naufal Rahman in WordPress Plugin Real 3D FlipBook versions 5.4...
CVE-2025-15696
The Real3D Flipbook WordPress plugin (versions before 5.4 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to a failure to sanitize or escape several flipbook editor fields before rendering them in the admin editor. This allows users with the Author role or higher to inject arbitra...
CVE-2025-15696 Real3D Flipbook Lite < 5.4 - Author+ Stored XSS
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the...
EUVD-2025-210995
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the...
CVE-2025-15696 Real3D Flipbook Lite < 5.4 - Author+ Stored XSS
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the...
PT-2026-97155
Name of the Vulnerable Software and Affected Versions Real3D Flipbook versions prior to 5.4 Description Insufficient sanitization and escaping of several flipbook editor fields allow users with the Author role and above to perform a stored cross-site scripting attack. This occurs when arbitrary w...
CVE-2026-86842: Missing Authorization
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...
PT-2026-97183
Name of the Vulnerable Software and Affected Versions Real3D Flipbook versions prior to 5.4 Description Insufficient capability checks on authenticated flipbook management actions allow users with Author-level access and above to delete flipbook content belonging to other users and overwrite glob...
CVE-2025-15696: Improper Neutralization of Input During Web Page Generation
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the...
CVE-2026-15098
The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute and other unsanitized attributes handled by onshortcode in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping...
EUVD-2026-83560
The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute and other unsanitized attributes handled by onshortcode in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping...
CVE-2026-15098
The Real3D Flipbook Lite WordPress plugin (up to 5.1.1 ) has a Stored Cross-Site Scripting flaw in the on_shortcode() and print_global_options() functions. Shortcode attribute values (e.g. lightboxtext) are copied into $this->flipbook_options and emitted via wp_json_encode() inside a sequence...
CVE-2026-15098: Improper Neutralization of Input During Web Page Generation
The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute and other unsanitized attributes handled by onshortcode in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping...