CVE-2026-2569
Received Received - Intake

Stored XSS in Dear Flipbook WordPress Plugin Allows Script Injection

Publication date: 2026-03-11

Last updated on: 2026-03-11

Assigner: Wordfence

Description
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PDF page labels in all versions up to, and including, 2.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-11
Last Modified
2026-03-11
Generated
2026-07-06
AI Q&A
2026-03-11
EPSS Evaluated
2026-07-05
NVD
CVE-2026-2569
EUVD
EUVD-2026-10953

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dear_flipbook pdf_flipbook to 2.4.20 (inc)
3d_flipbook dflip_lite 2.4.27

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Compliance Impact

I don't know

Executive Summary

The vulnerability in the Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is a Stored Cross-Site Scripting (XSS) issue. It occurs because the plugin does not properly sanitize and escape input from PDF page labels. This allows authenticated users with Author-level access or higher to inject malicious web scripts into pages. These scripts then execute whenever any user accesses the infected page.

Impact Analysis

This vulnerability can lead to the execution of arbitrary scripts in the context of the affected website. An attacker with Author-level access can inject malicious code that runs when other users view the infected pages. This can result in theft of user credentials, session hijacking, defacement, or other malicious actions that compromise the security and integrity of the website and its users.

Mitigation Strategies

To mitigate the vulnerability CVE-2026-2569 in the Dear Flipbook and 3D Flipbook WordPress plugins, you should update the plugin to version 2.4.27 or later, which includes a fix for this security issue.

  • Update the 3d-flipbook-dflip-lite plugin to version 2.4.27.
  • Verify that your WordPress installation is compatible with the updated plugin (tested with WordPress 5.9).
  • Review and apply any additional security best practices for WordPress plugins, such as limiting Author-level access to trusted users.
Detection Guidance

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2569. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart