CVE-2026-8625: Dear Flipbook WordPress Plugin XSS Vulnerability

CVE-2026-8625 Overview

CVE-2026-8625 is a Stored Cross-Site Scripting (XSS) vulnerability in the Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress. The flaw affects all plugin versions up to and including 2.4.30. The root cause is insufficient input sanitization and output escaping in the post_content parameter processed through the Custom HTML block. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes when users view an affected page. The vulnerability is categorized under CWE-79.

Critical Impact
Contributor-level authenticated users can inject persistent JavaScript that executes in the browser of any visitor rendering the affected page, enabling session hijacking, credential theft, and administrative account takeover.

Affected Products

Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress (versions ≤ 2.4.30)
Plugin slug: 3d-flipbook-dflip-lite
Fixed in version 2.4.37

Discovery Timeline

2026-09-05 - CVE-2026-8625 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-8625

Vulnerability Analysis

The vulnerability resides in the client-side parseThumbs() function within dflip.js. When the plugin renders a page containing a .df-element div with the attribute data-df-lightbox='thumb', the inner HTML of that element is passed as the title argument to parseThumbs(). The function then writes this untrusted content into a span element via innerHTML and constructs an img element without sanitizing attribute boundaries. This creates two exploitation primitives from a single injection point.

Because the payload persists in the WordPress post content, the script executes every time a visitor loads the affected page. The scope is marked as changed in the CVSS vector, indicating that a low-privileged contributor can affect resources beyond their authorization boundary, including administrator sessions.

Root Cause

The underlying issue is missing output escaping in the JavaScript renderer. The parseThumbs() routine, referenced at lines 2712, 2718, 2791, and 2796 of dflip.js in version 2.4.27, treats attacker-controlled DOM content as trusted markup. Neither the server-side WordPress sanitization pipeline nor the client-side render function neutralizes HTML tags, event handlers, or attribute delimiters before assignment.

Attack Vector

A Contributor inserts a Custom HTML block containing a crafted <div class="df-element" data-df-lightbox="thumb"> element. The inner HTML of that div is then used to build a span via innerHTML assignment and an img element whose attributes can be escaped using an onerror handler. When any user, including administrators, previews or visits the page, the injected JavaScript executes in their browser context under the site's origin. See the Wordfence Vulnerability Report and the WordPress Changeset 3641463 for the patched code paths.

No verified public exploit code is available. The vulnerability mechanism is described in the referenced advisory.

Detection Methods for CVE-2026-8625

Indicators of Compromise

Post or page content containing <div> elements with class df-element and attribute data-df-lightbox="thumb" combined with unexpected script tags or event handlers in the inner HTML.
Custom HTML blocks authored by Contributor-role accounts that reference df-element markup outside legitimate Dear Flipbook shortcode usage.
Outbound browser requests from administrator sessions to unfamiliar domains shortly after viewing a page created by a low-privilege user.

Detection Strategies

Audit the wp_posts table for post_content values matching the pattern data-df-lightbox=["']thumb["'] alongside onerror, onload, or <script> substrings.
Enable a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from post content.
Review WordPress role assignments and identify Contributor and Author accounts created or modified recently.

Monitoring Recommendations

Log and alert on edits to posts by Contributor-level accounts using WordPress audit logging plugins.
Monitor plugin version inventory across WordPress deployments to confirm upgrade to 2.4.37 or later.
Correlate administrator session anomalies (unexpected password resets, new admin users) with recent page views of Contributor-authored content.

How to Mitigate CVE-2026-8625

Immediate Actions Required

Update the Dear Flipbook plugin to version 2.4.37 or later on all WordPress installations.
Review all Contributor and Author accounts and remove any that are unnecessary or unrecognized.
Inspect existing posts and pages for malicious df-element markup and remove injected content before republishing.

Patch Information

The vendor addressed the vulnerability in version 2.4.37 by adding sanitization to the parseThumbs() render path. The fix is documented in WordPress Changeset 3641463 and the changeset comparison between 2.4.30 and 2.4.37.

Workarounds

Restrict Contributor and Author role assignments until the plugin is upgraded.
Disable the Custom HTML block for lower-privileged roles using a capability management plugin.
Deploy a Web Application Firewall (WAF) rule to block requests containing data-df-lightbox="thumb" combined with event handler attributes.
Temporarily deactivate the Dear Flipbook plugin if immediate patching is not feasible.

bash

# Configuration example: WP-CLI upgrade and role audit
wp plugin update 3d-flipbook-dflip-lite --version=2.4.37
wp user list --role=contributor --fields=ID,user_login,user_registered
wp user list --role=author --fields=ID,user_login,user_registered