CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Responsive FlipBook Plugin Wordpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the rfbwp_save_settings() functionin all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Explanation of Vulnerability in Simple Terms
The Responsive FlipBook plugin for WordPress versions 2.5.0 and earlier does not properly check user permissions before allowing access to certain functions. A logged-in user with low privileges can read or modify data they should not have access to, and the impact may extend beyond the plugin itself. Update to a version newer than 2.5.0.
What an attacker can do
Read or modify data across the site that should be restricted to higher-privilege users.
Potential impact on your site
Unauthorized users can access or alter sensitive site content and settings without admin approval.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
