The Dear Flipbook WordPress plugin allows an authenticated user with contributor or higher privileges to insert a Base64-encoded JSON object into the class attribute of a .dvcss element inside a Custom HTML block. When the page is rendered, the plugin’s client‑side parseCSSElements() routine decodes the value with atob() and JSON.parse() and renders the contained logo property as raw HTML. Because neither server‑ nor client‑side sanitization occurs prior to insertion, the browser executes the injected script whenever a visitor accesses the page, enabling the attacker to run arbitrary JavaScript in the site context.

The vulnerability affects the Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer WordPress plugin in any release up to and including version 2.4.30.

The CVSS score of 6.4 indicates a moderate severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog. The attack vector requires authentication, limiting exploitation to users with contributor‑level or higher access. Once exploited, the attacker can execute arbitrary JavaScript whenever the compromised page is viewed.