[ CVE-2025-15696 · Published 23 Sep 2026 ]
Vulnerability in Unknown Real3D Flipbook
CVSS 6.8
EPSS <1%No fix listed yet
[ Description ]Official description
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.