Junglewise Threat Intelligence

CVE-2026-8625: Dear Flipbook stored cross-site scripting in Custom HTML block

CVE-2026-8625 · Severity: medium · CVSS 6.4 · Published 2026-09-05

Executive brief

Dear Flipbook is a WordPress plugin that allows users to embed PDF documents and create interactive flip-book displays on web pages. The plugin fails to properly sanitize user input in Custom HTML blocks, allowing contributors and higher-level users to inject malicious scripts that execute in the browsers of anyone viewing affected pages, potentially compromising visitor data or injecting malware.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the Dear Flipbook WordPress plugin versions up to 2.4.30. Attackers with contributor-level access or higher can craft a .df-element div with data-df-lightbox='thumb' inside a Custom HTML block; the inner HTML is passed unsanitized to the parseThumbs() function at render time, enabling injection of arbitrary scripts via innerHTML manipulation and attribute breakout through an onerror handler on a constructed img element. The vulnerability requires authenticated access (contributor role minimum) but affects all users viewing the injected page. No patch information is provided in the advisory.

Affected products

  • dFlip Dear Flipbook up to and including 2.4.30

Timeline

  • 2026-09-05: disclosed

References