CVE-2025-15696
Deferred Deferred - Pending Action

Real3D Flipbook Admin Editor XSS Vulnerability

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-10-13
AI Q&A
2026-09-23
EPSS Evaluated
2026-10-12
NVD
CVE-2025-15696
EUVD
EUVD-2025-210995

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
real3d flipbook to 5.4 (exc)
real3d flipbook_lite to 5.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Real3D Flipbook WordPress plugin before version 5.4 has a stored cross-site scripting (XSS) vulnerability. It fails to sanitize or escape certain flipbook editor fields, allowing users with the Author role or higher to inject malicious scripts. These scripts execute in the browsers of other users, including administrators, when they open the affected flipbook for editing.

Detection Guidance

Check WordPress installations for the Real3D Flipbook plugin versions prior to 5.4. Inspect admin editor fields for suspicious scripts in flipbook content. Review user roles with Author access or higher for unauthorized changes.

Impact Analysis

This vulnerability allows attackers with Author-level access or higher to inject malicious scripts into flipbooks. When administrators or other users edit these flipbooks, the scripts execute in their browsers, potentially stealing session cookies, performing actions on their behalf, or redirecting them to malicious sites.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements. If exploited, it may result in data breaches, unauthorized data access, or loss of user trust, potentially leading to legal penalties and compliance violations.

Mitigation Strategies

Update the Real3D Flipbook plugin to version 5.4 or later immediately. Remove or restrict Author role access to only trusted users. Monitor admin editor fields for unexpected scripts or changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15696. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart