The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress suffers from a stored cross-site scripting vulnerability due to insufficient sanitization and escaping of the 'style' and 'mode' parameters. Authenticated attackers with Contributor or higher privileges can inject arbitrary web scripts into pages, which execute upon page access. This issue is limited to block-based themes and affects all versions up to 1.16.15. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, privileges at the contributor level, no user interaction, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an authenticated user with Contributor-level access or above to inject persistent malicious scripts into pages. These scripts execute in the context of users viewing the affected pages, potentially leading to unauthorized actions or data disclosure. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a patch is available, restrict Contributor-level access to trusted users only and consider disabling or replacing the affected plugin if possible. No vendor advisory states that no action is required or that the issue is mitigated.