CVE-2025-5314 Overview
CVE-2025-5314 is a DOM-Based Reflected Cross-Site Scripting (XSS) vulnerability in the Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress. The flaw affects all versions up to and including 2.3.65 and stems from insufficient input sanitization and output escaping on the pdf-source parameter. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser when the victim clicks a crafted link. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and unauthorized administrative actions on WordPress sites running the vulnerable plugin.
Affected Products
- Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress
- All versions up to and including 2.3.65
- WordPress installations with the 3d-flipbook-dflip-lite plugin activated
Discovery Timeline
- 2025-07-01 - CVE-2025-5314 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5314
Vulnerability Analysis
The vulnerability resides in the client-side JavaScript logic of the Dear Flipbook plugin, specifically within dflip.js. The plugin reads the pdf-source parameter from the DOM or URL and passes it into a rendering context without adequate sanitization or output encoding. Because the sink is reached entirely in the browser, this qualifies as DOM-Based XSS rather than a traditional server-reflected variant.
An attacker can craft a URL containing a malicious payload in the pdf-source parameter and lure a target user to click the link. When the plugin processes the parameter, the injected script executes in the origin of the vulnerable WordPress site. The scope-changed impact (S:C in the CVSS vector) reflects that scripts execute in the security context of the hosting page and can affect resources beyond the immediate component.
Root Cause
The root cause is missing input sanitization and output escaping for user-controlled data flowing into a DOM sink. The plugin trusts the pdf-source value and injects it into page context where it is interpreted as executable script. Review the WordPress Plugin JavaScript File referenced at line 8861 for the affected code path.
Attack Vector
Exploitation requires user interaction. An attacker crafts a URL to a page on the target WordPress site that includes a manipulated pdf-source query parameter carrying a JavaScript payload. When a victim clicks the link, the plugin's client-side code parses the parameter and injects the attacker-controlled string into the DOM. The payload then executes with the privileges of the visiting user, which may include administrative session cookies if the victim is a logged-in site administrator. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-5314
Indicators of Compromise
- HTTP request logs containing the pdf-source parameter with URL-encoded <script>, javascript:, or event handler payloads such as onerror= or onload=.
- Referer headers from suspicious external domains directing users to plugin-rendered pages with unusual query strings.
- Unexpected outbound requests from browser sessions to attacker-controlled domains shortly after a user visits a flipbook page.
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule to inspect and block pdf-source values containing HTML tags, JavaScript URI schemes, or common XSS payload patterns.
- Monitor WordPress access logs for requests to pages embedding the Dear Flipbook plugin with anomalously long or encoded pdf-source values.
- Implement Content Security Policy (CSP) reporting endpoints to capture violations that indicate injected inline script execution.
Monitoring Recommendations
- Alert on WordPress plugin inventory changes and track sites running 3d-flipbook-dflip-lite at or below version 2.3.65.
- Correlate browser telemetry with URL parameters passed to flipbook pages to identify suspicious payload delivery attempts.
- Track authenticated administrator sessions for anomalous actions such as new user creation or plugin installation following clicks on external links.
How to Mitigate CVE-2025-5314
Immediate Actions Required
- Update the Dear Flipbook plugin to a version above 2.3.65 that includes the fix referenced in the WordPress Changeset Update.
- Audit WordPress administrator accounts and rotate credentials if suspicious activity is observed following user clicks on external links.
- Deploy a WAF rule that filters the pdf-source parameter for script injection payloads until patching is complete.
Patch Information
The vendor has published a fix in the plugin's trunk. Review the WordPress Changeset Update for the specific code changes that introduce proper sanitization and escaping for the pdf-source parameter. Site administrators should upgrade through the WordPress plugin management interface or via WP-CLI.
Workarounds
- Temporarily deactivate the Dear Flipbook plugin on affected WordPress installations until the patched version is deployed.
- Restrict access to pages embedding flipbook viewers using authentication or IP allowlisting where feasible.
- Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources to reduce DOM-Based XSS impact.
# Update the Dear Flipbook plugin using WP-CLI
wp plugin update 3d-flipbook-dflip-lite
# Verify installed version
wp plugin get 3d-flipbook-dflip-lite --field=version
# Temporarily deactivate the plugin if patching is delayed
wp plugin deactivate 3d-flipbook-dflip-lite
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
