CVE-2026-8623: Dear Flipbook WordPress Plugin XSS Vulnerability

CVE-2026-8623 Overview

CVE-2026-8623 is a Stored Cross-Site Scripting (XSS) vulnerability in the Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress. The flaw affects all versions up to and including 2.4.30. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript through the post_content parameter, specifically via the class attribute of a .dvcss element. The malicious payload executes in the browser of any visitor who views the affected page. The issue is tracked as [CWE-79] and is documented in the Wordfence Vulnerability Report.

Critical Impact
Authenticated contributors can plant persistent JavaScript that runs in every visitor's browser, enabling session theft, credential harvesting, and administrative account takeover.

Affected Products

Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress
All versions up to and including 2.4.30
Fixed in version 2.4.37

Discovery Timeline

2026-09-05 - CVE-2026-8623 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-8623

Vulnerability Analysis

The vulnerability resides in the frontend JavaScript logic of the Dear Flipbook plugin, specifically the parseCSSElements() function inside dflip.js. The plugin allows content authors to embed custom configuration data inside the class attribute of a .dvcss element, which is placed inside a WordPress Custom HTML block. That configuration payload is a Base64-encoded JSON object.

At render time, parseCSSElements() extracts the encoded string, decodes it client-side with atob(), and parses the result with JSON.parse(). The parsed object's logo property is then written directly into the Document Object Model (DOM) as raw HTML. No sanitization runs on either the server or the client before insertion. As a result, contributor-level users can persist arbitrary markup, including <script> tags and event handlers, that executes in every visitor's browser session.

Root Cause

The root cause is missing input sanitization on the server and missing output escaping in the client-side renderer. The plugin trusts the decoded JSON structure and writes the logo property as raw HTML rather than as text content. This is a textbook stored XSS pattern classified under [CWE-79].

Attack Vector

An attacker requires an account with at least contributor privileges on the target WordPress site. The attacker crafts a JSON payload containing a malicious logo value, Base64-encodes it, and embeds it as a class name on a .dvcss element inside a Custom HTML block. When any user, including administrators, loads a page containing that block, the plugin decodes and injects the payload into the DOM, executing the attacker's script in the victim's authenticated context.

Refer to the vulnerable code paths in the Dear Flipbook JavaScript file at line 2687 and line 11255 for the exact rendering logic.

Detection Methods for CVE-2026-8623

Indicators of Compromise

Custom HTML blocks containing <div> or similar elements with a dvcss class whose class list includes long Base64-encoded strings.
Outbound requests from site visitors' browsers to unfamiliar domains shortly after page render.
Unexpected administrative account creation or plugin installations following contributor content publication.
Presence of Dear Flipbook plugin at version 2.4.30 or earlier in wp-content/plugins/3d-flipbook-dflip-lite/.

Detection Strategies

Audit stored post and page content for .dvcss elements that carry Base64-encoded class values, then decode and inspect the JSON logo property for HTML or script content.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from plugin-rendered DOM nodes.
Correlate WordPress post_content changes made by contributor-role users with subsequent client-side script execution events.

Monitoring Recommendations

Enable and centralize WordPress audit logging for post and page revisions, especially edits made by contributor and author roles.
Monitor web server logs for anomalous request patterns to pages containing Dear Flipbook shortcodes.
Track plugin version inventory across managed WordPress sites and alert on installations of 3d-flipbook-dflip-lite at version 2.4.30 or below.

How to Mitigate CVE-2026-8623

Immediate Actions Required

Upgrade the Dear Flipbook plugin to version 2.4.37 or later on all WordPress installations.
Review all published and draft content created by contributor and author accounts for .dvcss elements containing Base64 class strings.
Rotate administrator session cookies and passwords if any suspicious content is found.
Restrict contributor and author role assignments to trusted users only.

Patch Information

The vendor addressed the issue in Dear Flipbook version 2.4.37. The fix is available in the WordPress Changeset Update and can be compared against the vulnerable release using the WordPress Changeset Comparison.

Workarounds

Deactivate the Dear Flipbook plugin until patching is complete if immediate upgrade is not feasible.
Enforce a strict Content Security Policy that blocks inline script execution on public-facing pages.
Temporarily downgrade contributor and author accounts or require editor review before publication of Custom HTML blocks.
Use a web application firewall (WAF) rule to block requests writing .dvcss class values with Base64-encoded payloads exceeding a defined length.

bash

# Configuration example: identify vulnerable plugin installations
find /var/www -type f -name "dflip.js" -path "*3d-flipbook-dflip-lite*" \
  -exec grep -l "parseCSSElements" {} \;

# Verify installed plugin version via WP-CLI
wp plugin get 3d-flipbook-dflip-lite --field=version

# Update to the patched release
wp plugin update 3d-flipbook-dflip-lite --version=2.4.37