CVE-2026-86842

Name of the Vulnerable Software and Affected Versions Real3D Flipbook versions prior to 5.4

Description Insufficient capability checks on authenticated flipbook management actions allow users with Author-level access and above to delete flipbook content belonging to other users and overwrite global settings reserved for administrators. This flaw can be exploited to perform a stored Cross-Site Scripting (XSS) attack, where malicious JavaScript is executed in the context of any visitor or administrator viewing the site.

Recommendations Update the plugin to version 5.4 or later.