The 3D FlipBook – PDF Flipbook WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with contributor-level or higher privileges can inject arbitrary web scripts via the plugin's bookmark feature, which are then stored and executed in the context of other users viewing the affected pages. This vulnerability affects all versions up to and including 1.15.3. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity. There is no vendor advisory or patch information provided, and the plugin is not a cloud service.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or unauthorized actions performed on behalf of users. Availability is not impacted. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the bookmark feature to reduce risk. Monitor official channels for updates or patches from the plugin vendor.