Real3D Flipbook 3D Flipbook Pdf Flipbook Pdf Viewer Pdf Embedder
Monthly
Stored cross-site scripting in the Real3D Flipbook Lite WordPress plugin (versions up to and including 5.1.1) allows authenticated attackers holding Contributor-level access or higher to inject arbitrary JavaScript into pages via the 'lightboxtext' shortcode attribute and other attributes processed by on_shortcode(). The payload is persisted through the normal WordPress save path and renders inside a <script type="application/json"> block emitted by wp_json_encode() without the JSON_HEX_TAG flag, so a crafted value can break out of the JSON context and execute when a privileged user (typically an Editor or Administrator previewing or moderating the pending post) views the affected page. Successful exploitation therefore depends on a higher-privileged user opening the injected content, which is a meaningful precondition; no public exploit code has been identified at time of analysis, and there is no evidence of confirmed active exploitation (no CISA KEV listing).
Stored cross-site scripting in the Real3D Flipbook Lite WordPress plugin (versions up to and including 5.1.1) allows authenticated attackers holding Contributor-level access or higher to inject arbitrary JavaScript into pages via the 'lightboxtext' shortcode attribute and other attributes processed by on_shortcode(). The payload is persisted through the normal WordPress save path and renders inside a <script type="application/json"> block emitted by wp_json_encode() without the JSON_HEX_TAG flag, so a crafted value can break out of the JSON context and execute when a privileged user (typically an Editor or Administrator previewing or moderating the pending post) views the affected page. Successful exploitation therefore depends on a higher-privileged user opening the injected content, which is a meaningful precondition; no public exploit code has been identified at time of analysis, and there is no evidence of confirmed active exploitation (no CISA KEV listing).