CVE-2026-15098 Overview
CVE-2026-15098 is a Stored Cross-Site Scripting [CWE-79] vulnerability in the Real3D Flipbook Lite plugin for WordPress, affecting versions up to and including 5.1.1. The flaw resides in the on_shortcode() and print_global_options() functions, where shortcode attribute values such as lightboxtext are copied into $this->flipbook_options and emitted through wp_json_encode() without the JSON_HEX_TAG flag. Authenticated attackers with Contributor-level access can inject arbitrary JavaScript that executes when Editors or Administrators preview the injected content.
Critical Impact
Contributor-level accounts can plant persistent JavaScript that runs in the browser sessions of higher-privileged reviewers, enabling account takeover and privilege escalation within WordPress.
Affected Products
- Real3D Flipbook Lite plugin for WordPress, all versions up to and including 5.1.1
- WordPress sites that permit Contributor-level registration or content submission
- Editorial workflows where Editors or Administrators preview pending posts containing the plugin's shortcode
Discovery Timeline
- 2026-09-19 - CVE-2026-15098 published to the National Vulnerability Database
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-15098
Vulnerability Analysis
The Real3D Flipbook Lite plugin registers a shortcode handler that stores caller-supplied attribute values inside a plugin state object. The plugin then serializes that object to JSON and prints it inside a <script type="application/json"> block on the page. Because wp_json_encode() is invoked without JSON_HEX_TAG, forward slashes and angle brackets are not escaped in the serialized output.
An attacker with Contributor privileges submits a post containing the flipbook shortcode with a malicious lightboxtext attribute. WordPress applies wp_kses_post at save time, which normally strips script tags. However, shortcode_parse_atts() later calls stripcslashes() on attribute values at render time. This lets the attacker encode the breakout payload as \\x3c/script\\x3e\\x3cscript\\x3e...\\x3c/script\\x3e, where each byte is stored as a benign backslash-hex escape sequence.
The escape bytes bypass wp_kses_post because they contain no HTML tags. At render, stripcslashes() converts them back into literal </script> and <script> sequences, breaking out of the JSON script context and executing the injected code in the reviewer's browser.
Root Cause
The root cause is insufficient output escaping in on_shortcode() and print_global_options(). Shortcode attribute values flow directly into a JSON script block without JSON_HEX_TAG, and the save-time wp_kses_post filter cannot detect payloads encoded as C-style escape sequences that only materialize after stripcslashes() runs.
Attack Vector
Exploitation requires authenticated access at the Contributor role or higher. The attacker creates or edits a post that embeds the vulnerable shortcode with a crafted lightboxtext attribute containing backslash-hex encoded script tags. When an Editor or Administrator previews the pending post to moderate it, the injected script executes with that reviewer's session context. Refer to the Wordfence Vulnerability Report and the WordPress Real3DFlipbook code snippet for the vulnerable sink.
Detection Methods for CVE-2026-15098
Indicators of Compromise
- Post or page content containing Real3D Flipbook shortcodes with attribute values that include \\x3c, \\x3e, or \\x2f byte sequences.
- Unexpected <script> fragments appearing inside <script type="application/json"> blocks emitted by the plugin.
- New administrator accounts, altered user roles, or plugin installations following review of pending Contributor posts.
Detection Strategies
- Scan the wp_posts table for shortcode attribute values matching regular expressions such as \\\x3c/?script targeting the plugin's shortcode name.
- Monitor rendered pages for the literal string </script><script> inside JSON script blocks associated with the flipbook.
- Review WordPress audit logs for Contributor accounts submitting posts that embed the Real3D Flipbook shortcode.
Monitoring Recommendations
- Alert on browser console errors or Content Security Policy violations originating from pages rendering the flipbook shortcode.
- Track privilege changes and plugin/theme modifications performed shortly after Editor or Administrator preview activity.
- Aggregate WordPress and web server logs into a centralized platform to correlate Contributor submissions with subsequent administrative actions.
How to Mitigate CVE-2026-15098
Immediate Actions Required
- Update Real3D Flipbook Lite to a version newer than 5.1.1 that includes the vendor's fix; see the WordPress Plugin Changeset.
- Audit existing posts and pages for the plugin's shortcode and remove any attribute values containing backslash-hex escape sequences.
- Review Contributor and Author accounts, revoking access for untrusted users until the plugin is patched.
Patch Information
The vendor addressed the issue in the plugin update tracked by the WordPress.org Plugin Changeset 3643539. The fix hardens on_shortcode() and print_global_options() output handling so shortcode attributes can no longer break out of the JSON script context.
Workarounds
- Deactivate the Real3D Flipbook Lite plugin until the patched version is deployed.
- Restrict who can submit or preview posts containing the plugin shortcode by tightening Contributor role capabilities.
- Deploy a Content Security Policy that disallows inline script execution to reduce impact if injection occurs.
# Configuration example: locate vulnerable installations via WP-CLI
wp plugin list --name=real3d-flipbook-lite --fields=name,status,version
wp plugin update real3d-flipbook-lite
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
