Security Alert Summary
The Dear Flipbook 13 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via PDF page labels in affected versions. Authenticated users with Author-level access or higher can inject scripts that execute when other users view an affected PDF page, due to insufficient input sanitization and output escaping.
CVE Details
- CVE ID: CVE-2026-2569
- Affected plugin / component: Dear Flipbook 13 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress
- Affected versions: All versions up to, and including, 2.4.20
- Published: March 11, 2026, 12:16 AM
- Last modified: March 11, 2026, 1:52 PM
- CVSS v3.1: Base Score 6.4 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Authenticated attacker required; privileges required: Low (Author-level and above); user interaction: None
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE / weakness: CWE-79 (Stored Cross-Site Scripting)
Technical Details
This vulnerability is a stored cross-site scripting issue that arises from insufficient input sanitization and output escaping of PDF page labels handled by the plugin. An authenticated user with Author-level access or higher can insert arbitrary web scripts into PDF page labels. Those scripts are stored and will execute in the context of any user who views the affected PDF page.
The root cause, as stated in the CVE description, is missing or inadequate sanitization/escaping of input used in PDF page labels. No specific PHP functions or REST endpoints are named in the CVE entry; the vulnerability is described at the component level (PDF page labels).
Impact is limited to what XSS typically enables within the browser context: execution of injected scripts in visitors’ browsers when they load an infected page. The CVSS impacts indicate confidentiality and integrity impacts are low and availability is not affected.
How This Could Impact Your Website
Consider a small team-managed site where the site owner maintains administrative oversight, internal staff contribute content, and external contractors or guest authors upload PDFs. If an Author-level account or higher inserts a crafted PDF with malicious page labels, those scripts can run when other users view the PDF pages. Practical consequences include disclosure of information visible to a user in their browser session, manipulation of page content viewed by staff or contributors, and increased risk of targeted social engineering or phishing against internal users whose email addresses or display names are exposed elsewhere on the site.
The CVSS data indicates limited confidentiality and integrity impacts rather than a full site compromise, but the presence of stored XSS still raises the risk of account-level data exposure and deceptive content delivered to users. If you9re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and authors.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior related to uploaded PDFs and content changes.
If you9d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
