Description

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (Custom HTML block inner HTML)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can insert a crafted .df-element div with data-df-lightbox='thumb' via a Custom HTML block, whose inner HTML is passed as the title argument to parseThumbs() at render time, enabling both innerHTML injection into a span element and attribute breakout via an onerror handler on a constructed img element.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-05T06:17:10.690Z",
  "pubdate": "2026-09-05T06:17:10.690Z",
  "executiveSummary": "A Stored Cross-Site Scripting (XSS) vulnerability exists in the 'Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer' plugin for WordPress, affecting all versions up to and including 2.4.30. The flaw stems from insufficient input sanitization and output escaping of the 'post_content' parameter, specifically when processing the inner HTML of a Custom HTML block.\nAuthenticated attackers with contributor-level privileges or higher can exploit this vulnerability to inject malicious JavaScript into WordPress posts or pages. When an administrative user or site visitor accesses the compromised page, the injected script executes within their browser session. This can lead to session hijacking, unauthorized administrative actions, or complete site takeover, posing a significant security risk to multi-author WordPress sites.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of input sanitization and output escaping within the plugin's rendering logic. Specifically, the vulnerability is triggered when the plugin parses custom HTML blocks containing elements designed for lightbox rendering.\nAn attacker with contributor-level permissions can craft a post containing a '.df-element' div element. This element is configured with the attribute 'data-df-lightbox' set to 'thumb'. During the rendering phase, the plugin's frontend scripts locate these elements and extract their inner HTML content.\nThe extracted inner HTML is subsequently passed as the 'title' argument to the internal 'parseThumbs()' JavaScript function. Because the function processes this parameter without prior sanitization, it enables two primary attack vectors during the generation of the user interface.\nFirst, the unsanitized input is injected directly into a 'span' element's innerHTML, allowing the rendering of arbitrary HTML tags. Second, the input is utilized to construct an 'img' element. By crafting a payload that breaks out of the HTML attribute quotes, the attacker can append an arbitrary event handler, such as 'onerror', to execute JavaScript when the browser attempts to load the image.\nBecause the payload is stored within the database as part of the post content, the execution occurs automatically and repeatedly for every user who visits the affected page, requiring no further interaction beyond viewing the published content."
}