Real3D Flipbook Lite CVE-2026-15098

Requires an authenticated account with Contributor-level capability or higher on a WordPress site running Real3D Flipbook Lite ≤5.1.1 (PR:L). The attacker must be able to use the flipbook shortcode with the 'lightboxtext' or other on_shortcode()-handled attribute. The stored payload does not self-execute on public pages in the typical case; per the description it fires when a privileged user (Editor/Administrator) previews or moderates the injected pending post - so successful compromise depends on that moderation/preview action occurring, which realistically limits exploitation despite the vendor's UI:N rating. The core defect is wp_json_encode() emitting shortcode-controlled data into a <script type="application/json"> block without the JSON_HEX_TAG flag, combined with shortcode_parse_atts() applying stripcslashes() so \x3c-encoded breakout bytes survive the wp_kses_post save filter.

This is a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) reflects a network-reachable stored XSS requiring authenticated Contributor-level access (PR:L), with scope change (S:C) because injected script executes in a higher-privileged victim's browser session. No EPSS score, KEV listing, or public POC was provided, so exploitation status is: no public exploit identified at time of analysis. The realistic risk is bounded by two factors the raw score understates: the attacker must already hold a Contributor+ account on the target site, and - despite the vendor's UI:N - the description itself states execution occurs 'whenever a user (typically an Editor or Administrator previewing/moderating the pending post) accesses an injected page,' which implies a human moderation action is required to fire the payload. That tension between UI:N in the vector and the description's explicit reliance on an admin/editor previewing the pending post should be verified against the vendor advisory. The severity is credible for a WordPress privilege-escalation-via-XSS chain (Contributor → Admin session), but it is a targeted, prerequisite-heavy issue rather than a wormable mass-exploitation flaw.

An attacker registers or obtains a Contributor account on a WordPress site running Real3D Flipbook Lite ≤5.1.1, then creates a pending post containing the flipbook shortcode with a 'lightboxtext' (or other) attribute encoded as \x3c/script\x3e\x3cscript\x3e...\x3c/script\x3e. The escape-byte encoding survives the wp_kses_post save-time filter and is decoded to real HTML at render time; when an Editor or Administrator previews or moderates the pending post, the script breaks out of the JSON <script> block and executes in their authenticated session, enabling account/site takeover. No public exploit code is identified at time of analysis.