CVE-2024-1081: 
WordPress vulnerability analysis and mitigation

The 3D FlipBook – PDF Flipbook WordPress plugin is affected by a Stored Cross-Site Scripting vulnerability (CVE-2024-1081) in versions up to and including 1.15.3. The vulnerability was discovered and disclosed on February 21, 2024, affecting the plugin's bookmark feature (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's bookmark feature. The CVSS v3.1 base score is 5.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N according to NIST's assessment, while Wordfence rates it at 6.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the affected page (NVD).

The vulnerability can be exploited by authenticated users with contributor-level or higher permissions. The attack requires low complexity and can be executed remotely, though user interaction is required for the exploit to be successful (NVD).

A patch has been released to address this vulnerability. Users are advised to update to a version newer than 1.15.3 (NVD).