Stored Cross-Site Scripting Vulnerability in 3D FlipBook - PDF Embedder Plugin for WordPress

CVE-2025-5289

What is CVE-2025-5289?

The 3D FlipBook – PDF Embedder plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and insufficient output escaping with the ‘style’ and 'mode' parameters. This vulnerability allows authenticated users with Contributor-level or higher access to inject malicious web scripts. When a user accesses a compromised page, the injected scripts could execute, potentially leading to unauthorized actions or data theft. This issue solely impacts block-based themes, emphasizing the necessity for consistent security practices in plugin development and usage.

References