The vulnerability resides in the Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer WordPress plugin and allows an attacker to inject arbitrary script payloads via the 'pdf-source' parameter. Because the plugin performs insufficient input sanitization and output escaping, a crafted URL can produce executable JavaScript in a victim’s browser, enabling classic XSS attacks. The primary impact is the compromise of the affected user’s browser session, which may lead to credential theft, session hijacking or other client‑side attacks. This weakness corresponds to CWE‑79.

All installations of the Dear Flipbook plugin for WordPress up to and including version 2.3.65 are affected. The plugin is distributed by dearhive under the name Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer. Users running any of these versions should verify the installed version and plan an upgrade.

The CVSS score of 6.1 places the issue in the medium severity range. The EPSS score is reported as less than 1%, indicating a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to persuade a user to visit a malicious link containing a crafted 'pdf-source' value; the vulnerability is therefore a DOM‑based reflected XSS that does not require authentication or possession of an admin account. The overall risk is moderate but could be elevated if the plugin is widely used on high‑traffic sites.