CVE-2024-0895 is a stored cross-site scripting vulnerability in the Dear Flipbook WordPress plugin (versions up to 2.2.26). The flaw is due to improper neutralization of input during web page generation, specifically in the outline settings feature. Authenticated users with contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the injected pages. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 5.4, indicating medium severity. No vendor advisory or patch links are provided, and the plugin is not a cloud service.

An authenticated attacker with contributor-level or higher permissions can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who view the compromised pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or content manipulation. There is no indication of availability impact. The vulnerability does not appear to be exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or limiting use of the outline settings feature in the Dear Flipbook plugin. Monitor vendor channels for updates and apply patches promptly once released.