Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2025-15696— Real3D Flipbook Lite < 5.4 - Author+ Stored XSS

Quick assessment

Affected

Unknown Real3D Flipbook

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 WordPress 插件 Real3D Flipbook 版本 5.4 之前的版本中，多个翻转书编辑器字段在重新渲染到后台编辑器时未经过净化或转义处理，导致具有作者（Author）及更高角色的用户能够注入任意 Web 脚本。这些脚本会在任何后续打开该受影响的翻转书进行编辑的用户的浏览器中执行，其中包括管理员用户。

AI Predicted 6.4 Difficulty: Easy EPSS 0.43% · P38 Updated Sep 23, 2026

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Unknown	Real3D Flipbook	`< 5.4`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Real3D Flipbook Lite < 5.4 - Author+ Stored XSS

Source: CVE Program / CVE List V5

Vulnerability Description

The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Real3D Flipbook	0 ~ 5.4	-

II. Public POCs for CVE-2025-15696

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2025-15696

请登录查看更多情报信息。

Other References for CVE-2025-15696 (1)

https://wpscan.com/vulnerability/7b454d8e-e2cd-4990-a72d-339b8065d359/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2025-15696

Same Patch Batch · Unknown · 2026-09-23 · 57 CVEs total

CVE-2026-86601	6.5 MEDIUM	WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Conte
CVE-2026-86612	5.6 MEDIUM	Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Dat
CVE-2026-84091	5.3 MEDIUM	SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forge
CVE-2026-90950	5.3 MEDIUM	Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form
CVE-2026-87978	5.3 MEDIUM	Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscripti
CVE-2026-87071	5.3 MEDIUM	Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts
CVE-2026-87070	5.3 MEDIUM	Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing
CVE-2026-86604	4.8 MEDIUM	GTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email Translation
CVE-2026-87848	3.7 LOW	MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure
CVE-2026-93511		Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass
CVE-2026-87069		Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe
CVE-2026-90985		WPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protected Product Des
CVE-2026-91024		Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)
CVE-2026-89331		FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Pub
CVE-2026-88997		JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
CVE-2026-87981		Paymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and
CVE-2026-87074		Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attac
CVE-2026-87979		Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via W
CVE-2026-88929		Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure
CVE-2026-86842		Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings O

Showing top 20 of 57 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Real3D Flipbook

CVE-2026-86842
Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and St

Same vendor: Unknown