Real 3D FlipBook CVE-2026-39760

Exploitation requires that a WordPress site have the Real 3D FlipBook plugin (version 5.5 or earlier) installed and active, and that a victim be induced to interact with attacker-supplied input (per UI:R, e.g. clicking a crafted link or loading a page carrying the payload) so the unsanitized value is reflected and executed in their browser. No attacker authentication is needed (PR:N). The principal limiting factor is the mandatory user interaction: the payload only fires in the victim's browser session, so there is no server-side compromise and no impact absent a lured victim; actual impact is further scoped to whatever privileges the targeted user's session holds.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) - consistent with a reflected/unauthenticated Cross-Site Scripting issue (CWE-79) rather than direct server compromise. No EPSS score was provided, no CISA KEV listing is present, and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The genuine real-world risk is moderate and bounded: this is a client-side scripting flaw whose impact (C:L/I:L/A:L) is limited and conditioned on tricking a victim into loading attacker-controlled input, not a mass-exploitable RCE. Signals are internally consistent (high-ish CVSS driven largely by S:C scope change and network vector), but with no EPSS/KEV/POC evidence this should be treated as a patch-in-normal-cycle WordPress plugin issue, not an emergency. Note the scope-change (S:C) and A:L in the supplied vector are generous for a typical reflected XSS and inflate the score; the availability impact in particular is questionable for XSS - verify against the Patchstack advisory.

An attacker crafts a URL or input containing a malicious JavaScript payload targeting a WordPress site running the Real 3D FlipBook plugin (version 5.5 or earlier) and lures a visitor or administrator into clicking it. When the victim's browser renders the unsanitized reflected input, the script executes in their session context, enabling cookie/session theft, redirection, or UI defacement. No authentication is required of the attacker, but the attack hinges on victim interaction; no public proof-of-concept was identified in the provided data.