Stored Cross-Site Scripting Vulnerability in 3D Flipbook Plugin for WordPress

CVE-2026-8625

What is CVE-2026-8625?

The 3D Flipbook plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability via the 'post_content (Custom HTML block inner HTML)' parameter. This flaw arises from insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access or higher to inject malicious web scripts. When exploited, these scripts are executed whenever users visit the impacted pages. An attacker can craft a Custom HTML block with a specific .df-element div containing elements that lead to innerHTML injection and attribute breakout, potentially jeopardizing user security and the integrity of the site.

References