Dearflip Pdf Flipbook 3D Flipbook Pdf Embed Pdf Viewer
Monthly
Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (versions ≤2.4.30) allows authenticated Contributor-level users to inject persistent JavaScript payloads into pages, executing in every subsequent visitor's browser. The attack exploits the `parseThumbs()` function in `dflip.js`, which unsafely accepts the inner HTML of `.df-element` divs from Custom HTML blocks as a `title` argument and writes it directly into the DOM without sanitization - enabling both direct `innerHTML` injection and attribute breakout via `onerror` event handlers on crafted `img` elements. No public exploit code or CISA KEV listing identified at time of analysis, but the scope-change (S:C) in the CVSS vector signals that successfully stored payloads affect all site visitors, including administrators.
Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (≤2.4.30) allows authenticated contributors to inject persistent JavaScript payloads that execute silently in any visitor's browser. The attack exploits the plugin's client-side parseCSSElements() function, which Base64-decodes JSON embedded in CSS class names of Custom HTML blocks via atob()/JSON.parse() and renders the logo property as raw innerHTML with no server-side or client-side sanitization intercept. No public exploit code identified at time of analysis; a patched version (2.4.37) has been released per WordPress SVN changeset references.
Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (versions ≤2.4.30) allows authenticated Contributor-level users to inject persistent JavaScript payloads into pages, executing in every subsequent visitor's browser. The attack exploits the `parseThumbs()` function in `dflip.js`, which unsafely accepts the inner HTML of `.df-element` divs from Custom HTML blocks as a `title` argument and writes it directly into the DOM without sanitization - enabling both direct `innerHTML` injection and attribute breakout via `onerror` event handlers on crafted `img` elements. No public exploit code or CISA KEV listing identified at time of analysis, but the scope-change (S:C) in the CVSS vector signals that successfully stored payloads affect all site visitors, including administrators.
Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (≤2.4.30) allows authenticated contributors to inject persistent JavaScript payloads that execute silently in any visitor's browser. The attack exploits the plugin's client-side parseCSSElements() function, which Base64-decodes JSON embedded in CSS class names of Custom HTML blocks via atob()/JSON.parse() and renders the logo property as raw innerHTML with no server-side or client-side sanitization intercept. No public exploit code identified at time of analysis; a patched version (2.4.37) has been released per WordPress SVN changeset references.