Skip to main content

Dearflip Pdf Flipbook 3D Flipbook Pdf Embed Pdf Viewer

2 CVEs product

Monthly

CVE-2026-8625 Sep 05, 05:30 MEDIUM This Month

Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (versions ≤2.4.30) allows authenticated Contributor-level users to inject persistent JavaScript payloads into pages, executing in every subsequent visitor's browser. The attack exploits the `parseThumbs()` function in `dflip.js`, which unsafely accepts the inner HTML of `.df-element` divs from Custom HTML blocks as a `title` argument and writes it directly into the DOM without sanitization - enabling both direct `innerHTML` injection and attribute breakout via `onerror` event handlers on crafted `img` elements. No public exploit code or CISA KEV listing identified at time of analysis, but the scope-change (S:C) in the CVSS vector signals that successfully stored payloads affect all site visitors, including administrators.

WordPress XSS Wordpress Plugin Dearflip Pdf Flipbook 3D Flipbook Pdf Embed Pdf Viewer Dearhive
NVD
CVSS 3.1
6.4
EPSS
0.2%
CVE-2026-8623 Sep 05, 05:30 MEDIUM This Month

Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (≤2.4.30) allows authenticated contributors to inject persistent JavaScript payloads that execute silently in any visitor's browser. The attack exploits the plugin's client-side parseCSSElements() function, which Base64-decodes JSON embedded in CSS class names of Custom HTML blocks via atob()/JSON.parse() and renders the logo property as raw innerHTML with no server-side or client-side sanitization intercept. No public exploit code identified at time of analysis; a patched version (2.4.37) has been released per WordPress SVN changeset references.

WordPress XSS Wordpress Plugin Dearflip Pdf Flipbook 3D Flipbook Pdf Embed Pdf Viewer Dearhive
NVD
CVSS 3.1
6.4
EPSS
0.2%
EPSS 0% CVSS 6.4
MEDIUM This Month

Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (versions ≤2.4.30) allows authenticated Contributor-level users to inject persistent JavaScript payloads into pages, executing in every subsequent visitor's browser. The attack exploits the `parseThumbs()` function in `dflip.js`, which unsafely accepts the inner HTML of `.df-element` divs from Custom HTML blocks as a `title` argument and writes it directly into the DOM without sanitization - enabling both direct `innerHTML` injection and attribute breakout via `onerror` event handlers on crafted `img` elements. No public exploit code or CISA KEV listing identified at time of analysis, but the scope-change (S:C) in the CVSS vector signals that successfully stored payloads affect all site visitors, including administrators.

WordPress XSS Wordpress Plugin +2
NVD
EPSS 0% CVSS 6.4
MEDIUM This Month

Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (≤2.4.30) allows authenticated contributors to inject persistent JavaScript payloads that execute silently in any visitor's browser. The attack exploits the plugin's client-side parseCSSElements() function, which Base64-decodes JSON embedded in CSS class names of Custom HTML blocks via atob()/JSON.parse() and renders the logo property as raw innerHTML with no server-side or client-side sanitization intercept. No public exploit code identified at time of analysis; a patched version (2.4.37) has been released per WordPress SVN changeset references.

WordPress XSS Wordpress Plugin +2
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy