CVE-2024-43152: 3D FlipBook Stored XSS Vulnerability

CVE-2024-43152 Overview

CVE-2024-43152 is a stored Cross-Site Scripting (XSS) vulnerability in the 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery WordPress plugin by iberezansky. The flaw affects all plugin versions from an unspecified release through 1.15.6. The plugin fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject persistent JavaScript payloads into pages rendered by the plugin. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated attackers can store malicious JavaScript that executes in the browser of any user visiting affected pages, enabling session theft, credential harvesting, and administrative account takeover.

Affected Products

iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery (WordPress plugin)
All versions up to and including 1.15.6
WordPress sites using the plugin: cpe:2.3:a:3dflipbook:3d_flipbook:*:*:*:*:*:wordpress:*:*

Discovery Timeline

2024-08-12 - CVE-2024-43152 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43152

Vulnerability Analysis

The vulnerability is a stored (persistent) XSS flaw in the 3D FlipBook plugin's input handling logic. User-controlled data submitted through plugin fields is written to persistent storage and later rendered into web pages without adequate output encoding or input sanitization. Because the payload persists in the WordPress database, every subsequent visitor to the affected page executes the attacker's JavaScript in the context of the site's origin.

Exploitation requires user interaction (a victim must load the page containing the injected payload) and can be triggered across a security scope boundary, meaning payloads injected in one context can affect users in a different privilege scope. This makes administrator session compromise a realistic outcome when a logged-in admin views a page containing the malicious flipbook content.

Root Cause

The plugin does not perform proper neutralization of special HTML and JavaScript characters (<, >, ", ', &) in one or more input fields before echoing that data into rendered HTML. WordPress provides sanitization primitives such as sanitize_text_field(), wp_kses(), and esc_html() for exactly this purpose, but the affected code paths do not consistently apply them.

Attack Vector

An attacker with the ability to submit content to the plugin — typically a contributor, author, or another low-privilege authenticated role — crafts input containing a JavaScript payload embedded in HTML attributes or tags. The payload is stored in the database. When any user, including administrators, loads a page that renders the affected flipbook content, the browser parses and executes the injected script. Consequences include session cookie theft, forced administrative actions via CSRF-like flows, defacement, and malware redirection.

The vulnerability manifests during output generation in the plugin's rendering logic. See the Patchstack Vulnerability Advisory for additional technical details.

Detection Methods for CVE-2024-43152

Indicators of Compromise

Unexpected <script>, onerror=, onload=, or javascript: strings stored in WordPress post metadata or plugin-specific database tables associated with 3D FlipBook content.
Outbound browser requests from authenticated admin sessions to attacker-controlled domains shortly after rendering a flipbook page.
New administrator accounts, unexpected role changes, or modified wp_users and wp_usermeta entries following visits to pages containing flipbook shortcodes.

Detection Strategies

Audit database tables used by the plugin for entries containing HTML event handlers or script tags using targeted SQL queries.
Deploy Content Security Policy (CSP) reporting to surface unauthorized inline script execution on pages using the plugin.
Review web server access logs for POST requests to plugin endpoints containing URL-encoded XSS patterns such as %3Cscript%3E or onerror%3D.

Monitoring Recommendations

Monitor WordPress admin sessions for anomalous API calls immediately following page views that include flipbook shortcodes.
Alert on modifications to privileged user accounts or plugin/theme installations that follow closely after authenticated admin browsing activity.
Track plugin version inventory across managed WordPress sites and flag any installation still running version 1.15.6 or earlier.

How to Mitigate CVE-2024-43152

Immediate Actions Required

Update the 3D FlipBook plugin to a version later than 1.15.6 as soon as a patched release is available from the vendor.
Restrict which user roles can submit or edit 3D FlipBook content, limiting exposure to trusted authors only.
Force a password reset and session invalidation for administrator accounts if the plugin has been in use with untrusted contributors.

Patch Information

The vendor advisory is published through Patchstack. Refer to the Patchstack Vulnerability Advisory for the current fixed version and upgrade guidance. Apply the fixed release through the WordPress plugin manager or WP-CLI.

Workarounds

Deactivate and remove the 3D FlipBook plugin until a patched version can be installed if immediate upgrade is not feasible.
Deploy a Web Application Firewall (WAF) rule to block requests containing script tags or JavaScript event handlers targeting the plugin's endpoints.
Implement a strict Content Security Policy that disallows inline scripts (script-src 'self') on pages that render flipbook content to reduce the impact of injected payloads.

bash

# Update the plugin via WP-CLI once a patched version is released
wp plugin update 3d-flipbook

# Verify installed version
wp plugin get 3d-flipbook --field=version

# If no patch is yet available, deactivate the plugin
wp plugin deactivate 3d-flipbook