Suredsi Ulpada

The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

**Name of the Vulnerable Software and Affected Versions** 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery versions prior to 1.16.21 **Description** Unauthenticated attackers can extract sensitive data from password-protected flipbooks by exploiting the `id` parameter. This allows the retrieval of the full metadata payload, including the title, outline, props, and the serialized data blob containing the direct URL of the underlying PDF file, which bypasses WordPress post-password confidentiality. Additionally, flipbook post IDs can be pre-enumerated using the unauthenticated `fb3d send posts` AJAX action. **Recommendations** Update the plugin to a version later than 1.16.20.