Real3D Flipbook EUVD-2025-210995

Requires an authenticated WordPress account with at least the Author role on the target site (per CVSS PR and description), plus user interaction (UI:R): a higher-privileged victim, typically an administrator, must subsequently open the malicious flipbook in the admin editor for the stored payload to fire. It applies only to sites running Real3D Flipbook before version 5.4 that grant untrusted users Author-or-above roles (e.g. multi-author or membership sites); a single-admin site or one that does not delegate authoring has little exposure. There is no unauthenticated or remote-without-account path.

This is a moderate-severity authenticated stored XSS (CWE-79) in the Real3D Flipbook WordPress plugin before 5.4. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H = 6.8) is internally inconsistent with the description in two ways: (1) it uses PR:H, but the description explicitly says exploitation requires only the 'Author role and above', which is a low-privilege contributor-tier role in WordPress and better matches PR:L; and (2) it keeps S:U with full C:H/I:H/A:H, yet the injected script executes in the browser of a DIFFERENT, higher-privileged user (an administrator opening the flipbook for editing), which is a classic scope change (S:C) with impact that for reflected/stored XSS is typically partial rather than a total confidentiality/integrity/availability compromise. The SSVC signals reinforce a non-urgent picture: Exploitation=none (no observed exploitation), Automatable=no (requires an authenticated actor and a victim admin to open the editor), while Technical Impact=total reflects the potential for admin-session takeover if the payload fires. There is no EPSS score, no CISA KEV listing, and no public POC provided, so real-world exploitation pressure is currently low. Net: this is a legitimate stored-XSS-to-privilege-escalation risk worth patching, but it is a bounded, insider/multi-tenant-site issue rather than a mass-exploited internet-facing emergency; the headline 6.8 slightly overstates individual metric choices (PR and scope) while the practical severity - an Author escalating to admin - remains the real concern.

On a multi-author WordPress site, a user holding only the Author role edits a flipbook and injects a malicious script into one of the unsanitized flipbook editor fields. When an administrator later opens that flipbook in the admin editor, the stored script executes in the admin's authenticated session, allowing account takeover or creation of a rogue admin. No public POC is provided at time of analysis.