CVE-2022-0423: 3dflipbook 3d Flipbook

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

The 3D FlipBook WordPress plugin before 1.12.1 does not have authorisation and CSRF checks when updating its settings, and does not have any sanitisation/escaping, allowing any authenticated users, such as subscriber to put Cross-Site Scripting payloads in all pages with a 3d flipbook.

Affected products

• 3dflipbook 3d Flipbook: before 1.12.1 (fixed in 1.12.1)

Published 2022-03-21. Last modified 2026-06-17.