CVE-2026-15098

Received Received - Intake

Stored XSS in Real3D Flipbook Lite WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute (and other unsanitized attributes handled by on_shortcode()) in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping in the on_shortcode() and print_global_options() functions: shortcode attribute values are copied verbatim into $this->flipbook_options and then emitted via wp_json_encode() inside a <script type="application/json"> block without the JSON_HEX_TAG flag, allowing a literal </script> byte sequence in the attribute value to break out of the JSON script context. Because WordPress's shortcode_parse_atts() applies stripcslashes() to attribute values, an attacker can encode the breakout tag as \x3c/script\x3e\x3cscript\x3e…\x3c/script\x3e, which survives the wp_kses_post save-time filter applied to Contributor content (the escape bytes are safe text characters, not HTML tags) and is decoded to real angle brackets at render time. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user (typically an Editor or Administrator previewing/moderating the pending post) accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-15098

Affected Vendors & Products

Vendor	Product	Version / Range
real3d	flipbook_lite	to 5.1.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Real3D Flipbook Lite WordPress plugin affecting versions up to 5.1.1. The issue occurs because the plugin fails to properly sanitize input in shortcode attributes like 'lightboxtext'. Attackers with Contributor-level access or higher can inject malicious scripts that execute when other users view the page, due to improper escaping of script tags in JSON output.

Detection Guidance

This vulnerability requires manual inspection of WordPress sites using the Real3D Flipbook Lite plugin versions up to 5.1.1. Check plugin versions in WordPress admin panel. Review posts/pages for unusual script content in shortcode attributes like lightboxtext. Look for encoded sequences such as \x3c/script\x3e in database entries.

Impact Analysis

If you use this plugin, an attacker could steal cookies, session tokens, or other sensitive data from users viewing your WordPress site. They could also perform actions on behalf of users, modify page content, or redirect users to malicious sites. The impact depends on user privileges - Editors and Administrators are most at risk as they can preview posts containing the injected scripts.

Compliance Impact

This vulnerability could lead to violations of GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized access to personal data. If user data is compromised through this XSS attack, organizations may face regulatory fines, legal consequences, and reputational damage for failing to protect sensitive information.

Mitigation Strategies

Immediately update the Real3D Flipbook Lite plugin to the latest version. Remove or restrict Contributor-level access to untrusted users. Review and sanitize all posts/pages containing shortcodes from this plugin. Consider disabling the plugin temporarily if an update is unavailable.

Hi! I’m here to help you understand CVE-2026-15098. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70