WordPress plugin · real3d-flipbook-lite
Is Real3D Flipbook safe?
Safe on 5.8 or newer.
The current version, 5.8, is past every affected range on record (12 of 12 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 12
- High or critical
- 5
- Exploited
- none
- Current version
- 5.8
- Last updated
- Oct 16, 2026
- Active installs
- 10,000+
Every recorded flaw
- Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.CVE-2026-39760 · affects up to 5.5 · reported by PatchstackHigh 7.1
- Sep 23, 2026Real3D Flipbook: Does not perform capability checks on several of its authenticated flipbook management actionsCVE-2026-86842 · fixed in 5.4 · reported by WPScanMedium 6.8
- Sep 23, 2026Real3D Flipbook: Does not sanitize or escape several flipbook editor fields before rendering them back in the admin editorCVE-2025-15696 · fixed in 5.4 · reported by WPScanMedium 6.8
- Sep 19, 2026Real3D Flipbook Lite: Stored Cross-Site ScriptingCVE-2026-15098 · affects up to 5.1.1 · reported by WordfenceMedium 6.4
- Feb 19, 2026Real 3D FlipBook: Missing AuthorizationCVE-2026-25423 · affects up to 4.19.1 · reported by PatchstackLow 3.8
- Dec 24, 2025Real 3D FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68512 · affects up to 4.11.4 · reported by PatchstackMedium 6.5
- Nov 15, 2024Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder: Arbitrary file uploadsCVE-2024-9849 · affects up to 4.8 · reported by Wordfence1.2% oddsHigh 8.8
- May 8, 20243D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34561 · affects up to 3.71 · reported by PatchstackMedium 5.9
- Apr 22, 20243D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32694 · affects up to 3.62 · reported by PatchstackHigh 7.1
- Sep 16, 2019The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter.CVE-2016-10967 · affects 1.0 to 1.0 · reported by MITRE1.0% oddsMedium 6.1
- Sep 16, 2019The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload.CVE-2016-10966 · affects 1.0 to 1.0 · reported by MITRE2.6% oddsHigh 7.5
- Sep 16, 2019The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion.CVE-2016-10965 · affects 1.0 to 1.0 · reported by MITRE2.2% oddsHigh 7.5
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.