FlippingBook’s WordPress plugin contains a DOM‑based XSS flaw caused by improper neutralization of user input during page generation. An attacker can supply malicious data that is rendered directly into the plugin’s output, allowing the execution of arbitrary JavaScript within the context of a site visitor’s browser. Based on the description, it is inferred that this could enable theft of session cookies, defacement of the site, or delivery of phishing payloads.

All installations of the FlippingBook WordPress plugin with a version of 2.0.1 or earlier are affected. The flaw applies to the plugin bundle across all supported WordPress environments, regardless of hosting or server platform.

The CVSS score of 6.5 places the issue in the moderate severity range, and the EPSS score of less than 1% indicates a low current probability of exploitation in the wild. The vendor has not listed the flaw in CISA’s KEV catalog. Exploitation is likely to occur through crafted URLs or input fields that the plugin fails to sanitize, and does not require privileged access to the site server. The attack vector is inferred as web‑based injection targeting end‑user browsers.