The Real3D Flipbook WordPress plugin before version 5.4 fails to perform capability checks on certain management actions. Users with Author-level access and above can delete flipbook content belonging to other users and overwrite global settings that are intended to be administrator only. Those overwritten settings can store JavaScript that executes in the context of any site visitor or administrator, creating a stored cross‑site scripting vulnerability. The primary impact is privilege escalation combined with stored XSS, allowing an attacker to manipulate site content and run code in visitors’ browsers.

Any WordPress installation running the Real3D Flipbook plugin at a version earlier than 5.4 is affected. The vulnerability resides completely in the plugin code, so all hosts using the plugin in this version range are susceptible regardless of domain or server configuration.

The CVSS score of 6.8 indicates moderate severity. The EPSS score of < 1% shows that the exploitation probability is very low at the time of analysis and the flaw is not listed in the CISA KEV catalog. The likely attack vector is an authenticated author account; an attacker must log in and then use the WordPress admin interface to perform the unauthorized actions. No external input beyond existing author privileges is required. Given the moderate score and low exploitation likelihood, the risk is moderate but still actionable.