CVE-2025-15696

MediumCVSS 6.8

Published: 23/09/2026(UTC)Updated: 14/10/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor. This allows users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.

Risk Assessment

An attacker with Author privileges can perform a stored XSS attack targeting administrators, potentially leading to session hijacking or actions executed with administrator privileges.

Recommendation

Update the Real3D Flipbook plugin to version 5.4 or later. Limit the number of accounts with the Author role to the necessary minimum.

Other vulnerabilities in Real3D Flipbook WordPress plugin

CVE-2026-86842Medium
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several authenticated flipbook management actions. This allows users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site.

Original NVD description (English source)

The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS