The 3D FlipBook plugin for WordPress allows an attacker with Contributor or higher access to inject arbitrary JavaScript by abusing the style and mode parameters when adding or editing a block. The input is not sanitized or escaped, so the payload is stored in the page content and executed each time a user opens the affected page, enabling an attacker to deface the site, steal credentials, or deliver malware.

WordPress sites that have installed versions of the 3D FlipBook – PDF Embedder, PDF Flipbook Viewer or Flipbook Image Gallery plugin equal to or older than 1.16.15 and that use block‑based themes.

The vulnerability has a CVSS score of 6.4, indicating moderate severity. The EPSS score of less than 1 % suggests a low probability of public exploitation, and it is not listed in the CISA KEV catalog. Attackers must authenticate with a role that can modify blocks; once the malicious payload is stored, any visitor to the page will trigger the script. Because only block‑based themes are affected, the opportunity to exploit is limited to sites using the newer Gutenberg editor.