CVE-2026-8625: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in dearhive DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer

CVE-2026-8625 is a stored cross-site scripting vulnerability in the DearFlip WordPress plugin (versions up to and including 2.4.30). It occurs due to improper neutralization of input in the 'post_content' parameter of Custom HTML blocks, allowing authenticated contributors or higher to inject arbitrary web scripts. These scripts execute when users access the compromised pages. The attack vector involves inserting a crafted .df-element div with data-df-lightbox='thumb', which is passed as the title argument to the parseThumbs() function at render time, leading to innerHTML injection into a span element and attribute breakout via an onerror handler on an img element. This vulnerability is tracked as CWE-79 and has a CVSS 3.1 base score of 6.4 (medium severity). No official patch or remediation guidance has been published yet.

The vulnerability allows authenticated users with contributor-level privileges or higher to inject malicious JavaScript into pages viewed by other users. This can lead to the execution of arbitrary scripts in the context of the affected site, potentially resulting in session hijacking, defacement, or other client-side attacks. The CVSS vector indicates network attack vector, low attack complexity, low privileges required (contributor-level), no user interaction needed, and impacts confidentiality and integrity with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting the use of Custom HTML blocks in pages using the DearFlip plugin. Monitor official vendor channels for updates and apply patches promptly once released.