The Dear Flipbook plugin for WordPress contains a stored cross‑site scripting flaw in the handling of PDF page labels. When an authenticated author or higher user supplies malicious content for a page label, that content is stored in the PDF metadata and output without proper validation or escaping. As a result, arbitrary JavaScript can be injected and executed in the browser of any user who opens the affected PDF page. The weakness is a classic CWE‑79 input validation issue that can compromise user sessions and site integrity.

All installations of the Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, and PDF viewer plugin running any version up to and including 2.4.20 are affected. The vulnerability applies to every WordPress site that has the plugin installed without applying the available patch.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with Author or higher privileges, so the attack vector is authenticated. Once exploited, injected scripts run in the victims’ browsers, giving attackers the ability to hijack sessions, deface content, or perform further malicious actions. The risk is to user confidentiality, integrity, and availability of the site’s content but does not provide arbitrary code execution on the server.