Executive brief
Dear Flipbook is a WordPress plugin that allows users to embed PDF documents and create interactive flip-book displays on web pages. The plugin fails to properly sanitize user input in Custom HTML blocks, allowing contributors and higher-level users to inject malicious scripts that execute in the browsers of anyone viewing affected pages, potentially compromising visitor data or injecting malware.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Dear Flipbook WordPress plugin versions up to 2.4.30. Attackers with contributor-level access or higher can craft a .df-element div with data-df-lightbox='thumb' inside a Custom HTML block; the inner HTML is passed unsanitized to the parseThumbs() function at render time, enabling injection of arbitrary scripts via innerHTML manipulation and attribute breakout through an onerror handler on a constructed img element. The vulnerability requires authenticated access (contributor role minimum) but affects all users viewing the injected page. No patch information is provided in the advisory.
Affected products
- dFlip Dear Flipbook up to and including 2.4.30
Timeline
- 2026-09-05: disclosed