CVE-2026-8625 in DearFlip Plugin
Summary
by MITRE • 09/05/2026
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (Custom HTML block inner HTML)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can insert a crafted .df-element div with data-df-lightbox='thumb' via a Custom HTML block, whose inner HTML is passed as the title argument to parseThumbs() at render time, enabling both innerHTML injection into a span element and attribute breakout via an onerror handler on a constructed img element.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in Dear Flipbook for WordPress versions up to 2.4.30 represents a significant security risk stemming from insufficient input sanitization and output escaping mechanisms within the plugin's handling of user-generated content. Specifically, this flaw affects the post_content parameter when utilized through Custom HTML blocks, allowing authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. The core technical issue lies in how the plugin processes inner HTML passed as part of a crafted .df-element div containing specific attributes such as data-df-lightbox set to thumb. When this content is rendered, it flows through functions like parseThumbs(), which fails to adequately validate or escape the input before injecting it into the DOM structure. This lack of rigorous validation enables an attacker to execute arbitrary web scripts whenever a victim user accesses a page containing the injected payload, leading to potential session hijacking, defacement, or further malware distribution depending on the context and privileges of the affected users.
From a technical perspective, the exploitation vector involves constructing a malicious HTML block that exploits both innerHTML injection vulnerabilities and attribute breakout techniques. By inserting an img element with an onerror handler within the crafted div structure, attackers can trigger JavaScript execution even if standard event handlers are filtered or restricted in some contexts. This method bypasses basic sanitization checks because the vulnerability occurs during the rendering phase rather than at initial input storage, meaning that traditional input validation alone may not suffice without corresponding output encoding strategies. The attacker leverages contributor-level permissions to create posts containing these malicious elements, which remain dormant until viewed by other users who have access rights to those pages. This persistence mechanism classifies it as a stored cross-site scripting vulnerability rather than reflected XSS, increasing its severity due to the broader potential impact across multiple user sessions and interactions with compromised content over time.
The operational impact of this vulnerability extends beyond immediate script execution, potentially compromising sensitive data such as administrative credentials if an administrator views the infected page while logged in. Attackers can steal cookies, session tokens, or other authentication artifacts stored by browsers, facilitating unauthorized access to higher-privileged accounts within the WordPress environment. Additionally, malicious scripts could redirect users to phishing sites designed to capture login information from unsuspecting visitors. In enterprise environments where Dear Flipbook might be used for displaying important documents or presentations, this vulnerability undermines trust in digital content integrity and exposes organizations to reputational damage alongside direct security breaches. The ability to execute code with the privileges of any viewing user amplifies the risk profile significantly compared to lower-impact vulnerabilities that require specific conditions or limited audience exposure.
Mitigation strategies must address both immediate remediation steps and long-term defensive measures aligned with industry standards such as CWE-79 for improper neutralization of input during web page generation, commonly known as Cross-site Scripting. Organizations should immediately update the Dear Flipbook plugin to version 2.4.31 or later where this issue has been resolved through enhanced sanitization routines and strict output escaping protocols. Until updates are applied, administrators can implement Web Application Firewall rules that detect and block common XSS payloads involving img tags with onerror attributes inside custom HTML blocks within WordPress posts. Furthermore, enforcing least privilege principles by restricting contributor-level access to only necessary functionalities reduces the attack surface available for exploitation. Regular security audits focusing on input validation layers across all plugins ensure early detection of similar flaws before they can be exploited in production environments.
In terms of threat intelligence frameworks like MITRE ATT&CK, this vulnerability aligns with techniques related to client-side code injection and potentially initial access via compromised credentials if session hijacking succeeds. Security teams should monitor for unusual patterns involving post_content modifications from contributor accounts and investigate any reports of unexpected script execution or redirection behaviors on public-facing pages hosting flipbook content. Implementing Content Security Policy headers can also provide an additional layer of defense by restricting sources from which scripts are allowed to load, thereby mitigating the impact even if some injection attempts succeed partially. Continuous monitoring combined with proactive patch management remains essential for maintaining robust security posture against evolving web application threats targeting popular CMS ecosystems like WordPress.