CVE-2026-8625

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (Custom HTML block inner HTML)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can insert a crafted .df-element div with data-df-lightbox='thumb' via a Custom HTML block, whose inner HTML is passed as the title argument to parseThumbs() at render time, enabling both innerHTML injection into a span element and attribute breakout via an onerror handler on a constructed img element.

• CWE-79

• https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/tags/2.4.27/assets/js/dflip.js#L2712
• https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/tags/2.4.27/assets/js/dflip.js#L2718
• https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/tags/2.4.27/assets/js/dflip.js#L2791
• https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/tags/2.4.27/assets/js/dflip.js#L2796
• https://plugins.trac.wordpress.org/changeset/3641463/3d-flipbook-dflip-lite/trunk/assets/js/dflip.js
• https://plugins.trac.wordpress.org/changeset?old_path=%2F3d-flipbook-dflip-lite/tags/2.4.30&new_path=%2F3d-flipbook-dflip-lite/tags/2.4.37
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3641463%403d-flipbook-dflip-lite%2Ftags%2F2.4.37&old=3557511%403d-flipbook-dflip-lite%2Ftags%2F2.4.30
• https://www.wordfence.com/threat-intel/vulnerabilities/id/741150a3-1b2a-4b54-9dd5-992d3d7079dc?source=cve

Published

Sep 5, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8624The LJ comments import: reloaded plugin for WordPress is vul…6.1
• CVE-2026-86240A security flaw has been discovered in liufee FeehiCMS up to…4.7
• CVE-2026-86241A weakness has been identified in liufee FeehiCMS up to 2.1.…4.3
• CVE-2026-86242Bifrost HTTP transport before 2.0.0 accepts an enabled custo…8.1
• CVE-2026-86244A security vulnerability has been detected in FastAdmin up t…4.3
• CVE-2026-86245A vulnerability was detected in itsourcecode Sales and Inven…6.3
• CVE-2026-86250h3 versions before 2.0.1-rc.18 fail to validate the chunk co…7.5
• CVE-2026-86251h3 versions before 1.15.9 contain a path traversal vulnerabi…5.9
• CVE-2026-86252h3 versions before 1.15.9 fail to sanitize carriage return c…5.3
• CVE-2026-86253h3 (npm package) versions <= 2.0.1-rc.14 contain a path trav…5.9
• CVE-2026-86254wger versions through master contain an incomplete authoriza…6.8
• CVE-2026-86255wger before 2.5 fails to validate the maximum duration of ro…6.5