CVE-2025-5314

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pdf-source’ parameter in all versions up to, and including, 2.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 1, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-531407.0Use after free in Kernel Transaction Manager allows an authorized attacker to elevate privileges locally.CVE-2025-531417.8Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2025-531427.0Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.CVE-2025-531438.8Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over CVE-2025-531448.8Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over CVE-2025-531458.8Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over CVE-2025-531477.0Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2025-531485.7Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information overCVE-2025-531497.8Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.CVE-2025-53154.3An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 thaCVE-2025-531507.8Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.CVE-2025-531517.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2025-5314: Medium severity, CVSS 6.1 | Vulnix