Description

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (class attribute of .dvcss element)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is embedded as a Base64-encoded JSON object in a CSS class name on a Custom HTML block; the frontend parseCSSElements() function decodes it client-side with atob() and JSON.parse() and renders the logo property as raw HTML, meaning no server-side or client-side sanitization intercepts the malicious script before DOM insertion.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-05T06:17:10.547Z",
  "pubdate": "2026-09-05T06:17:10.547Z",
  "executiveSummary": "The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 2.4.30.\nThis vulnerability stems from improper input sanitization and output escaping within the plugin's CSS handling logic for the '.dvcss' element class attribute.\nAn authenticated attacker with contributor-level privileges or higher can leverage this flaw to inject arbitrary JavaScript payloads.\nThe malicious script is embedded within a Base64-encoded JSON object inside a Custom HTML block. When a victim views a page containing this element, the frontend 'parseCSSElements()' function decodes the payload and injects it directly into the Document Object Model (DOM) as raw HTML.\nSuccessful exploitation allows for the execution of unauthorized scripts in the context of the victim's session. Potential impacts include session hijacking, unauthorized actions on behalf of the victim, and the defacement of the affected WordPress site.\nThe attack is characterized as a persistent, stored vulnerability that does not require social engineering to trigger, as the script executes automatically upon rendering the affected page.",
  "technicalDetails": "The vulnerability is located in the client-side processing logic of the Dear Flipbook plugin, specifically within the 'parseCSSElements()' JavaScript function. The plugin allows users to define custom settings via a CSS class name applied to a '.dvcss' element within Custom HTML blocks.\nThe root cause is a lack of server-side input validation and client-side sanitization when processing the data contained within these class strings. The application expects a Base64-encoded JSON object representing various configuration parameters, including a 'logo' property.\nAn attacker with contributor-level access can craft a malicious JSON object where the 'logo' property contains a script tag or event handler (e.g., <img src=x onerror=alert(1)>). This JSON object is then Base64 encoded and placed as a CSS class name on a '.dvcss' element in a WordPress post or page.\nThe attack flow follows these steps: 1) The attacker injects the malicious Base64-encoded string into the 'post_content'. 2) When a user accesses the page, the browser invokes the 'parseCSSElements()' function. 3) The function identifies the '.dvcss' element, extracts the encoded class string, and executes 'atob()' to decode the payload. 4) The decoded string is parsed via 'JSON.parse()'. 5) The application retrieves the 'logo' property and directly inserts it into the DOM using a method that interprets the content as raw HTML without prior sanitization.\nBecause the execution happens client-side using native browser decoding functions, there are no security filters preventing the DOM insertion of malicious scripts. This bypasses typical WordPress security measures that might otherwise monitor or sanitize 'post_content' during server-side saving, as the payload is technically hidden within a CSS class selector.\nThe impact of this vulnerability is significant, as it enables stored XSS that persists across page loads for any user viewing the injected content. This allows for the theft of administrative session cookies, redirecting users to malicious domains, or performing administrative tasks if the victim is an administrator. The vulnerability affects all versions of the plugin up to 2.4.30, and the exploit is highly reliable as it relies on legitimate plugin functionality to process the malicious data."
}