CVE-2024-3883

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Bookmark URL field in all versions up to, and including, 1.15.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-388307.8VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigg CVE-2024-388317.8VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can inse CVE-2024-388326.4VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to i CVE-2024-388335.4VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might CVE-2024-388344.8VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might b CVE-2024-38847.5A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(Str CVE-2024-38855.4The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the subcontainer value parameter in a CVE-2024-388569.8Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade CVE-2024-388576.1Improper neutralization of input in Checkmk before versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows attackers to craft malicious CVE-2024-388586.1Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs CVE-2024-388596.1XSS in the view page with the SLA column configured in Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47 and 2.0.0 (EOL) allowed malici CVE-2024-38866.1The tagDiv Composer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘envato_code[]’ parameter in all versions u