Vulnerabilities / Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder / WPSEC-2026-0912
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder <= 5.5 - Unauthenticated DOM-Based Cross-Site Scripting via 'r3d-' URL Parameters
Medium 6.1
CWE-79Fixed in 5.7
- ID
- WPSEC-2026-0912
- Plugin
- Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder (real3d-flipbook-lite)
- Affected
- all versions before 5.7
- Remediation
- Update to 5.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder on WPSec AttackSurface
- Fix released
- Published
Description
The Real3D Flipbook plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via 'r3d-' prefixed URL parameters in all versions up to, and including, 5.5. This is due to the front-end embed script copying any 'r3d-<option>' query parameter into the flipbook options without validation, so HTML-bearing options reach innerHTML sinks in the viewer. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when they trick a user into opening a crafted link to a page containing a flipbook.
References
- https://wpsec.com/vuln/WPSEC-2026-0912/
- https://plugins.svn.wordpress.org/real3d-flipbook-lite/tags/5.7/
- https://wordpress.org/plugins/real3d-flipbook-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS