CVE-2025-69019

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the FlippingBook plugin for WordPress versions 2.0.1 and earlier. The issue stems from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts via DOM manipulation [1].

Exploitation requires user interaction, typically tricking a privileged user (such as an admin) into clicking a crafted link or submitting a malicious form. The vulnerability is often targeted in mass-exploit campaigns, affecting thousands of websites regardless of their size or popularity [1].

Successful exploitation enables an attacker to inject arbitrary JavaScript, leading to actions such as redirecting users to malicious sites, displaying unwanted advertisements, or stealing sensitive information from the victim's session [1].

The vendor has released version 2.0.2 to address this vulnerability. Users are advised to update immediately. For those unable to update, restricting privileged user interactions or seeking assistance from a hosting provider is recommended [1].