CVE-2025-15696: Real3D Flipbook WordPress XSS Vulnerability

CVE-2025-15696 Overview

CVE-2025-15696 is a stored Cross-Site Scripting (XSS) vulnerability in the Real3D Flipbook WordPress plugin versions before 5.4. The plugin fails to sanitize or escape several flipbook editor fields before rendering them in the admin editor. Authenticated users with the Author role or higher can inject arbitrary JavaScript that executes when another user, including an administrator, opens the affected flipbook for editing. The flaw is categorized as Improper Neutralization of Input During Web Page Generation [CWE-79].

Critical Impact
An Author-level account can inject JavaScript that executes in an administrator's browser session, enabling account takeover of the WordPress site.

Affected Products

Real3D Flipbook WordPress plugin versions prior to 5.4
WordPress installations with the plugin active and Author (or higher) accounts provisioned
Administrator sessions that open flipbooks authored by lower-privileged users

Discovery Timeline

2026-09-23 - CVE-2025-15696 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2025-15696

Vulnerability Analysis

The Real3D Flipbook plugin exposes an admin-side editor that renders user-supplied field values back to the DOM without output encoding. Any authenticated user with the Author role or above can save malicious payloads into these fields. When another user later loads the flipbook in the editor, the browser executes the injected script under the WordPress admin origin.

Because the payload executes in an administrator's authenticated session, an attacker can create new administrator accounts, modify plugin or theme code, or exfiltrate nonces to escalate to remote code execution. The vulnerability requires user interaction, since a privileged user must open the poisoned flipbook for editing.

Root Cause

The plugin does not apply WordPress sanitization APIs such as sanitize_text_field() on input, nor output-escaping functions such as esc_attr() or esc_html() when re-rendering flipbook editor fields. This omission allows raw HTML and script content to reach the admin DOM. See the WPScan Vulnerability Report for advisory detail.

Attack Vector

An attacker authenticates as an Author (or higher role granted permission to edit flipbooks), creates or edits a flipbook, and stores a JavaScript payload in a vulnerable editor field. The payload persists in the WordPress database. When an administrator opens the flipbook editor, the script runs in the administrator's browser, inheriting the admin session and capabilities.

// Verified proof-of-concept code is not published in the enriched data.
// Refer to the WPScan advisory for reproduction details:
// https://wpscan.com/vulnerability/7b454d8e-e2cd-4990-a72d-339b8065d359/

Detection Methods for CVE-2025-15696

Indicators of Compromise

Flipbook records in the WordPress database containing <script>, onerror=, onload=, or javascript: sequences in editor fields.
Unexpected administrator account creations following an admin session that edited a flipbook.
New or modified WordPress user roles, plugin files, or theme files shortly after an admin viewed a flipbook authored by a lower-privileged user.

Detection Strategies

Query the wp_posts and plugin-specific tables for Real3D Flipbook entries and inspect stored field values for HTML or script content.
Enable a Content Security Policy (CSP) in report-only mode on wp-admin to surface inline script executions originating from editor pages.
Review WordPress audit logs for Author-role accounts creating or editing flipbooks in the days preceding suspicious admin activity.

Monitoring Recommendations

Alert on POST requests to plugin admin-ajax or REST endpoints that contain angle brackets or event-handler attributes in flipbook fields.
Monitor for changes to the wp_users and wp_usermeta tables, particularly new users with the administrator role.
Track outbound requests from administrator browsers to unfamiliar domains during flipbook editing sessions.

How to Mitigate CVE-2025-15696

Immediate Actions Required

Update the Real3D Flipbook plugin to version 5.4 or later on all WordPress sites.
Audit existing flipbook entries for stored HTML or script content and remove suspicious payloads before administrators reopen them.
Review Author, Editor, and Administrator accounts for unauthorized additions or privilege changes.

Patch Information

The vendor addressed the issue in Real3D Flipbook version 5.4 by applying input sanitization and output escaping on the affected editor fields. Confirm patch status through the WordPress plugin management screen and consult the WPScan Vulnerability Report for advisory references.

Workarounds

Restrict flipbook editing capabilities to trusted administrators until the plugin is updated.
Deactivate the Real3D Flipbook plugin on sites that cannot be patched immediately.
Enforce a strict Content Security Policy on wp-admin that blocks inline script execution.

bash

# Update the Real3D Flipbook plugin using WP-CLI
wp plugin update real3d-flipbook --version=5.4

# Verify installed version
wp plugin get real3d-flipbook --field=version