Stored Cross-Site Scripting in PDF Flipbook, 3D Flipbook - DearFlip by WordPress

CVE-2024-11830

What is CVE-2024-11830?

The DearFlip plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate sanitization of user input in outline settings. Attackers with contributor-level permissions can exploit this flaw to inject malicious scripts into web pages. When users access these compromised pages, the injected scripts execute, potentially leading to unauthorized actions and data exposure. It is crucial for users to update to the latest version of the plugin to mitigate this security risk.

References