CVE-2025-5314: Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.65 - DOM-Based Reflected Cross-Site Scripting via 'pdf-source'
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pdf-source’ parameter in all versions up to, and including, 2.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5314?
CVE-2025-5314 is classified as a medium severity vulnerability due to its potential for exploitation via cross-site scripting.
How do I fix CVE-2025-5314?
To remediate CVE-2025-5314, update the Dear Flipbook plugin to the latest version beyond 2.3.65 or ensure that proper input sanitization and output escaping mechanisms are implemented.
What types of attacks can CVE-2025-5314 facilitate?
CVE-2025-5314 can facilitate DOM-Based Reflected Cross-Site Scripting attacks that may result in malicious scripts being executed in users' browsers.
Which versions of Dear Flipbook are affected by CVE-2025-5314?
All versions of Dear Flipbook up to and including 2.3.65 are affected by CVE-2025-5314.
Is user data at risk due to CVE-2025-5314?
Yes, CVE-2025-5314 poses a risk to user data as it could allow attackers to execute scripts that manipulate user sessions or steal sensitive information.