CVE-2024-8717: DearFlip WordPress Plugin XSS Vulnerability

CVE-2024-8717 Overview

CVE-2024-8717 is a reflected cross-site scripting (XSS) vulnerability in the DearFlip WordPress plugin, also known as PDF Flipbook, 3D Flipbook, PDF embed, and PDF viewer. The flaw affects all versions up to and including 2.3.32. The plugin fails to sanitize input and escape output on the pdf_source parameter, allowing unauthenticated attackers to inject arbitrary JavaScript. Successful exploitation requires a victim to click a crafted link, at which point the script executes in the victim's browser session on the affected WordPress site.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser, enabling session theft, credential harvesting, and administrative account takeover when an administrator is targeted.

Affected Products

DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress
All versions up to and including 2.3.32
WordPress sites using the 3d-flipbook-dflip-lite plugin slug

Discovery Timeline

2024-10-24 - CVE-2024-8717 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8717

Vulnerability Analysis

The DearFlip plugin renders PDF viewer content driven by request parameters, including pdf_source. Version 2.3.32 and earlier accept attacker-controlled values for this parameter and reflect them into the rendered page without sufficient sanitization or output escaping. This behavior falls under improper neutralization of input during web page generation [CWE-79].

Because the vulnerable code path is reachable without authentication, any visitor to the plugin's endpoint can be redirected through a crafted URL. The scope-changed CVSS vector indicates the injected script can affect resources beyond the immediate component, such as the administrator's session for the WordPress dashboard. User interaction is required, as the attack relies on a victim clicking a link or visiting a manipulated page.

Root Cause

The root cause is missing input validation and missing output encoding on the pdf_source parameter handled by the plugin's front-end JavaScript and PHP request handling. Values passed through the parameter are inserted into the DOM or reflected in the HTTP response without HTML entity encoding, allowing attacker-supplied markup and script tags to be interpreted by the browser.

Attack Vector

An attacker crafts a URL to a vulnerable WordPress site containing a malicious payload in the pdf_source parameter. The attacker delivers the URL through phishing emails, social media, forum posts, or malicious advertisements. When a logged-in user, especially an administrator, clicks the link, the payload executes in their browser under the site's origin. The script can then exfiltrate cookies, perform actions on behalf of the user, inject persistent backdoors through admin functionality, or redirect to attacker-controlled infrastructure.

No verified public exploit code has been published. Technical details describing the vulnerable JavaScript file are available in the WordPress plugin source and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-8717

Indicators of Compromise

HTTP requests containing pdf_source query parameter values with HTML tags, <script>, javascript:, onerror=, or onload= payloads
Referer headers indicating traffic from external domains landing on DearFlip plugin endpoints with unusual parameter content
Outbound requests from browser sessions to unknown domains shortly after users visit URLs containing DearFlip plugin parameters
WordPress administrator accounts creating unexpected users, plugins, or content shortly after clicking external links

Detection Strategies

Inspect web server access logs for requests to DearFlip endpoints containing URL-encoded script payloads in the pdf_source parameter
Deploy Web Application Firewall (WAF) rules that block reflected XSS patterns targeting WordPress plugin parameters
Monitor browser Content Security Policy (CSP) violation reports for inline script execution on pages hosting the plugin

Monitoring Recommendations

Alert on any HTTP GET or POST parameter values containing angle brackets, javascript: schemes, or common XSS payload signatures
Track WordPress admin session activity for anomalous configuration changes following link clicks from external referrers
Correlate plugin version inventory data with published vulnerability feeds to identify sites running DearFlip 2.3.32 or earlier

How to Mitigate CVE-2024-8717

Immediate Actions Required

Update the DearFlip plugin to a version newer than 2.3.32 that contains the fix from WordPress changeset 3172275
Audit WordPress administrator accounts for unauthorized users or role changes created since the plugin was installed
Rotate WordPress administrator passwords and invalidate active sessions if suspicious activity is detected
Enable multi-factor authentication for all WordPress administrator and editor accounts

Patch Information

The vendor addressed the vulnerability in WordPress changeset 3172275 by adding input sanitization and output escaping to the pdf_source parameter handling. Site administrators should update through the WordPress plugin dashboard or by replacing plugin files with the patched release. Confirm the installed version exceeds 2.3.32 after updating.

Workarounds

Deactivate and remove the DearFlip plugin until the patched version can be installed
Deploy WAF rules that block requests containing <, >, or script tokens in the pdf_source parameter
Restrict WordPress admin access by IP allowlist to reduce the pool of users who might click a malicious link while authenticated
Implement a strict Content Security Policy that disallows inline scripts and unauthorized script sources

bash

# Example ModSecurity WAF rule to block XSS in pdf_source parameter
SecRule ARGS:pdf_source "@rx (?i)(<script|javascript:|onerror=|onload=|<iframe)" \
    "id:1008717,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2024-8717 DearFlip pdf_source XSS attempt blocked',\
    tag:'attack-xss'"