3D FlipBook < 1.13.3 – Contributor+ Stored XSS | CVE 2022-4453 | Plugin Vulnerabilities

Description

The plugin does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like administrators.

Proof of Concept

1. As an administrator, create a 3d FlipBook.

2. Log in as a contributor, and create a post with the following shortcode in it

[3d-flip-book mode='fullscreen' id='1' classes='" onmouseover="alert(1)"']

3. Send the post for review (Publish) and preview the post.

Affects Plugins

interactive-3d-flipbook-powered-physics-engine

Fixed in 1.13.3

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Lana Codes

Submitter

Lana Codes

Submitter website

https://lana.codes/

Submitter twitter

Verified

Yes

WPVDB ID

120bdcb3-4288-4101-b738-cc84d02da171

Timeline

Publicly Published

2022-12-22 (about 3 years ago)

Added

2022-12-22 (about 3 years ago)

Last Updated

2022-12-27 (about 3 years ago)

Other

Published

Title

Published

2023-05-09

Title

Yoast SEO: Local < 14.9 - Reflected XSS

Published

2025-01-06

Title

App Embed < 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-09-19

Title

Author: Munzir <= 0.9 - Reflected Cross-Site Scripting

Published

2024-03-26

Title

Master Addons for Elementor < 2.0.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget

Published

2024-08-07

Title

Graphina < 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting