WordPress Plugin Vulnerabilities

Real3D FlipBook <= 2.8 - Multiple Vulnerabilities

Description

List of vulnerabilities:

- Delete any file or directory from the server (Unauthenticated)
- Upload images in Root directory (Unauthenticated)
- Cross-Site Scripting (XSS)

Proof of Concept

Affects Plugins

Plugin icon
real3d-flipbook
Fixed in 2.9

References

Exploitdb
40055
URL
https://codecanyon.net/item/real3d-flipbook-wordpress-plugin/6942587
URL
https://mukarramkhalid.com/wordpress-real-3d-flipbook-plugin-exploit/

Miscellaneous

Submitter
Mukarram Khalid
Submitter website
https://mukarramkhalid.com/
Submitter twitter
themakmaniac
Verified
No
WPVDB ID
958d9fdc-0a1b-4e7c-b1b2-9e231b4e1f00

Timeline

Publicly Published
2016-07-03 (about 9 years ago)
Added
2016-07-05 (about 9 years ago)
Last Updated
2019-11-01 (about 6 years ago)

Other

Published
Title
Published
2014-08-01
Title
image-gallery-with-slideshow <= 1.5 - Arbitrary File Upload / SQL Injection
Published
2019-05-25
Title
Related YouTube Videos <= 1.9.8 - CSRF & XSS
Published
2019-09-08
Title
Selio - Real Estate Directory <= 1.1 - SQL Injection & Persistent XSS
Published
2019-08-10
Title
Simple 301 Redirects Addon Bulk Uploader <= 1.2.4 - Multiple Issues
Published
2014-08-01
Title
Comment Rating 2.9.23 - Multiple Vulnerabilities