rootpwn

medium · CVSS v3 6.4 · EPSS 0.00193

CVE-2026-15098

The Real3D Flipbook Lite plugin for WordPress contains a stored cross‑site scripting flaw in the lightboxtext shortcode attribute. Attackers

Overview

The Real3D Flipbook Lite plugin for WordPress contains a stored cross‑site scripting flaw in the lightboxtext shortcode attribute. Attackers can inject malicious scripts that will run in the browsers of site visitors. The vulnerability affects all sites using the plugin up to version 5.1.1.

Description

The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute (and other unsanitized attributes handled by on_shortcode()) in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping in the on_shortcode() and print_global_options() functions: shortcode attribute values are copied verbatim into $this->flipbook_options and then emitted via wp_json_encode() inside a

Impact

Confidentiality: injected scripts can steal user data such as cookies or form inputs. Integrity: malicious code can alter page content or redirect users. Availability: minimal impact. Defenders: site administrators and users of the plugin are impacted.

Remediation

Update the plugin to the latest version (5.1.2 or later). If an update is not possible, disable the lightboxtext shortcode or implement input sanitization for shortcode attributes. Monitor the site for unexpected script execution and review logs for suspicious activity.

Risk context

Medium severity with an EPSS of 0.00193 indicates a low probability of exploitation but still warrants prompt patching to mitigate potential XSS attacks.

Affected products

  • WordPress
  • Real3D Flipbook Lite

Scores

Severity
medium
CVSS v2
5.5
CVSS v3
6.4
CVSS v4
—
EPSS
0.00193

wordpress xss stored-xss plugin real3d-flipbook wp-shortcode security

← All CVEs

Related CVEs

medium

CVE-2026-93956

A medium‑severity XSS flaw exists in olivier-ls PHP‑FTS up to 1.1.2. The vulnerability is triggered by manipulating the Query argument to SearchEngine::buildHighlights, allowing remote attackers to inject malicious scripts. It can be exploited via a web request to the affected component.

View analysis

medium

CVE-2026-93957

A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.4 is able to mitigate this issue. The identifier of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

View analysis

medium

CVE-2026-12402

The OTP Login & Register WooCommerce plugin for WordPress is vulnerable to stored XSS via the 'fb-config' setting. Authenticated administrators can inject scripts that execute for any user who views the affected page, enabling session hijacking or site defacement.

View analysis

medium

CVE-2026-13191

The Create plugin for WordPress (v2.5.3 and earlier) contains a SQL injection flaw in the order_by parameter that can be exploited by users with author-level or higher privileges. Attackers can inject arbitrary SQL to read sensitive database data. This vulnerability is exploitable via the REST API endpoint that defaults to publish_posts capability.

View analysis