The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer WordPress plugin is affected by a reflected XSS vulnerability via the 'pdf_source' parameter. This occurs due to insufficient input sanitization and output escaping, enabling injection of arbitrary web scripts. The vulnerability affects all versions up to and including 2.3.32. An attacker can exploit this by convincing a user to click a maliciously crafted link, causing script execution in the context of the vulnerable site. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website, potentially leading to information disclosure or manipulation of user interactions. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction (clicking a crafted link) and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links involving the 'pdf_source' parameter and consider disabling or restricting the plugin if possible. Monitor the vendor's communications for updates and apply patches promptly once available.