Executive brief
The Dear Flipbook WordPress plugin allows authenticated contributors to inject malicious scripts into pages by embedding them in CSS class names as Base64-encoded data. When a user views an affected page, the JavaScript code decodes and renders the injected script, leading to account compromise, session hijacking, or defacement. The plugin is widely used for displaying PDF content in WordPress sites.
Technical details
This is a Stored Cross-Site Scripting (XSS) vulnerability in the Dear Flipbook WordPress plugin affecting versions up to 2.4.30. The vulnerability exists in the post_content parameter (specifically the class attribute of .dvcss elements) where the frontend parseCSSElements() function decodes a Base64-encoded JSON object using atob() and JSON.parse(), then renders the logo property as raw HTML without sanitization. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts that persist in the database and execute in the context of any user viewing the page. No server-side or client-side sanitization occurs before DOM insertion, enabling full script execution.
Affected products
- trepmal Dear Flipbook up to 2.4.30
Timeline
- 2026-09-05: disclosed