Security Alert Summary
The Real3D Flipbook WordPress plugin before 5.4 fails to properly sanitize and escape several editor fields. Authenticated users with the Author role and above can inject arbitrary web scripts into flipbook editor fields that will execute in the browser of any user who later opens the affected flipbook for editing, including administrators.
CVE Details
- CVE ID: CVE-2025-15696
- Affected component: Real3D Flipbook WordPress plugin
- Affected versions: versions before 5.4 (less than 5.4)
- Published: September 23, 2026 at 6:17 AM UTC
- Last modified: September 23, 2026 at 11:17 AM UTC
- CVSS v3.1: Base score 6.8, MEDIUM
- Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- Vector:
- Authentication / privileges / user interaction:
- Privileges required: High (attacker must be an authenticated user with the Author role or higher)
- User interaction: Required
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The plugin does not sanitize or escape several flipbook editor fields before rendering them back into the admin editor. Because these fields are stored and later displayed in the editor, an authenticated user with Author privileges or higher can inject arbitrary web scripts (cross-site scripting) into those fields. When another user opens the affected flipbook for editing in the admin interface, the injected script runs in that user’s browser context.
The description identifies the root cause as missing sanitization/escaping of editor fields. No specific functions or REST API endpoints are named in the provided data. The impact is that attacker-supplied scripts execute in the context of users viewing the editor, potentially allowing actions available to that user in the browser (for example, reading visible data or performing actions available via the administrative UI in the browser session).
How This Could Impact Your Website
Consider a site where an external contractor or a contributor with Author access edits flipbooks. That user could insert a script into a flipbook field. Later, an internal staff member or the site owner who opens the flipbook for editing may have that script executed in their browser. Practical consequences include exposure of data visible to the editor interface (such as internal user email addresses) and an increased risk of targeted phishing or social engineering directed at staff or administrators.
For example, an injected script could exfiltrate information that is visible in the editor or create UI elements that trick administrators into taking unsafe actions. The vulnerability does not by itself claim full site compromise, but it raises the risk for privilege abuse and information disclosure when privileged users open affected flipbooks for editing.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially users with Contributor or Author roles.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and admin edits for unusual behavior or unexpected changes to flipbook content.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
