CVE-2026-8623: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in dearhive DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer

CVE-2026-8623 is a stored cross-site scripting vulnerability in the DearFlip WordPress plugin up to version 2.4.30. The flaw exists because the plugin does not properly sanitize or escape input in the 'post_content' parameter, specifically within the class attribute of the .dvcss element. Attackers with contributor-level privileges can embed a Base64-encoded JSON payload in a CSS class name on a Custom HTML block. The frontend parseCSSElements() JavaScript function decodes this payload client-side using atob() and JSON.parse(), then inserts the 'logo' property as raw HTML into the DOM without any sanitization, enabling script execution in users' browsers.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages, which execute in the context of users who view those pages. This can lead to information disclosure and integrity impacts such as theft of user credentials or session tokens. The CVSS 3.1 score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges (low), no user interaction, and partial confidentiality and integrity impact without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only. Monitor for plugin updates from dearhive addressing this vulnerability and apply official patches promptly once released.