CVE-2025-15696

MEDIUMCVSS 6.8

Description

The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.

Timeline

Published:September 23rd, 2026 6:17 AM

Last modified:October 14th, 2026 7:10 PM

CVSS Scoring

CVSS v3: 6.8 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-79

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/7b454d8e-e2cd-4990-a72d-339b8065d359/

Source: NIST NVD · Data may lag official sources by up to one minute