PT-2019-7760 · WordPress · Real3D-Flipbook-Lite

Mukarram Khalid · Published 2019-09-16 · Updated 2019-09-17 · CVE-2016-10967

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions real3d-flipbook-lite plugin version 1.0

Description The issue concerns a problem with the real3d-flipbook-lite plugin for WordPress, where there is a potential for XSS via the bookId parameter in the /wp-content/plugins/real3d-flipbook/includes/flipbooks.php endpoint.

Recommendations For real3d-flipbook-lite plugin version 1.0, avoid using the bookId parameter in the affected endpoint until the issue is resolved. Consider temporarily restricting access to the flipbooks.php file to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-10967

Affected Products

Real3D-Flipbook-Lite

References · 4

• 🔥 https://mukarramkhalid.com/wordpress-real-3d-flipbook-plugin-exploit · Exploit
• https://osv.dev/vulnerability/CVE-2016-10967 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10967 · Security Note
• https://wordpress.org/plugins/real3d-flipbook-lite/#developers · Note