3D FlipBook < 1.12.1 - Subscriber+ Stored Cross-Site Scripting
CVE-2022-0423

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
3d Flipbook – PDF Flipbook Viewer, Flipbook Image Gallery
Vendor
CVE Published:
21 March 2022

Summary

The 3D FlipBook WordPress plugin before 1.12.1 does not have authorisation and CSRF checks when updating its settings, and does not have any sanitisation/escaping, allowing any authenticated users, such as subscriber to put Cross-Site Scripting payloads in all pages with a 3d flipbook.

Affected Version(s)

3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery 1.12.1

References

https://wpscan.com/vulnerability/7dde0b9d-9b86-4961-b005-...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof Zając
.