The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute (and other unsanitized attributes handled by on_shortcode()) in v…
Medium CVSS 6.4
Summary
The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute (and other unsanitized attributes handled by on_shortcode()) in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping in the on_shortcode() and print_global_options() functions: shortcode attribute values are copied verbatim into $this->flipbook_options and then emitted via wp_json_encode() inside a <script type=…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://plugins.trac.wordpress.org/browser/real3d-flipbook-lite/tags/5.0/includes/Real3DFlipbook.php#L1224
- https://plugins.trac.wordpress.org/browser/real3d-flipbook-lite/tags/5.0/includes/Real3DFlipbook.php#L1468
- https://plugins.trac.wordpress.org/browser/real3d-flipbook-lite/tags/5.0/includes/Real3DFlipbook.php#L1668
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3643539%40real3d-flipbook-lite&new=3643539%40real3d-flipbook-lite
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f6df3abe-ef27-46d7-bbdd-abd994fce132?source=cve
Timeline
- nvd_ingest NVD