CVE-2026-2569: Dear Flipbook WordPress Plugin XSS Flaw

CVE-2026-2569 Overview

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 2.4.20. The vulnerability exists due to insufficient input sanitization and output escaping when processing PDF page labels. This security flaw allows authenticated attackers with Author-level access or above to inject arbitrary web scripts into pages, which execute whenever a user accesses the compromised content.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the context of victim browsers, potentially leading to session hijacking, credential theft, or further compromise of WordPress installations.

Affected Products

• Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress versions up to and including 2.4.20

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-2569 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-2569

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in the PDF page label handling functionality of the Dear Flipbook plugin. When users upload PDF documents, the plugin processes page labels embedded within the PDF metadata without properly sanitizing or escaping the content before rendering it in the browser.

The Stored XSS nature of this vulnerability makes it particularly dangerous as the malicious payload persists on the server and executes every time a user views the affected page. Unlike reflected XSS attacks, stored XSS does not require social engineering to trick users into clicking malicious links—the payload automatically triggers upon page access.

Root Cause

The root cause of this vulnerability lies in insufficient input sanitization and output escaping mechanisms when the plugin processes and displays PDF page labels. The Dear Flipbook plugin fails to properly validate and encode user-controlled data extracted from PDF metadata before inserting it into the DOM, allowing attackers to embed JavaScript code that executes in the victim's browser context.

Attack Vector

The attack requires authentication with at least Author-level privileges on the target WordPress installation. An attacker can exploit this vulnerability by:

1. Creating or uploading a specially crafted PDF document containing malicious JavaScript in the page label metadata
2. Using the Dear Flipbook plugin to embed the malicious PDF on a WordPress page or post
3. When legitimate users view the flipbook content, the injected script executes in their browser session

The malicious scripts can perform actions such as stealing session cookies, redirecting users to phishing pages, modifying page content, or performing actions on behalf of the authenticated user. This can lead to account takeover, especially if administrative users access the compromised pages.

Detection Methods for CVE-2026-2569

Indicators of Compromise

• Unexpected JavaScript code or encoded script tags appearing in PDF page labels within the WordPress database
• Suspicious entries in the wp_posts or plugin-related tables containing script elements
• Browser-based alerts or unexpected behaviors when viewing Dear Flipbook content
• Network traffic to unknown external domains originating from flipbook pages

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common XSS payloads in PDF-related requests
• Conduct regular security audits of content created by Author-level users
• Use browser-based XSS auditing tools to scan flipbook pages for stored malicious scripts
• Review plugin database tables for suspicious content containing <script> tags or JavaScript event handlers

Monitoring Recommendations

• Enable detailed logging for user uploads and content modifications in WordPress
• Monitor for unusual patterns in PDF uploads, particularly from newly created author accounts
• Implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS exploitation
• Set up alerts for modifications to flipbook content by monitoring file integrity and database changes

How to Mitigate CVE-2026-2569

Immediate Actions Required

• Update the Dear Flipbook plugin to a version newer than 2.4.20 immediately
• Review existing flipbook content for potentially malicious JavaScript injections
• Audit user accounts with Author-level access and above for suspicious activity
• Consider temporarily disabling the plugin until the patch is applied

Patch Information

The vendor has released a security patch addressing this vulnerability. For technical details on the code changes, refer to the WordPress Plugin Changeset. Additional vulnerability information is available in the Wordfence Vulnerability Report.

Update the plugin through the WordPress admin dashboard by navigating to Plugins → Installed Plugins → Dear Flipbook and clicking "Update Now" if an update is available.

Workarounds

• Restrict Author-level access to trusted users only until the patch is applied
• Implement a Content Security Policy (CSP) header to prevent inline script execution
• Use a WordPress security plugin to scan for and block XSS payloads in uploaded content
• Manually review and sanitize PDF page labels before publishing flipbook content

# WordPress CLI command to update the plugin
wp plugin update dear-flipbook --force

# Add CSP header via .htaccess as a temporary mitigation
# Add to your .htaccess file:
Header set Content-Security-Policy "script-src 'self'; object-src 'self'"