CVE-2026-109973: Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter

Q: Which WordPress sites are realistically exposed to contributor-level exploitation?

Exploitation requires a contributor or higher account to have the plugin's editing capability. This can occur when an administrator delegates the plugin's “Who can edit” capability in its Settings page; on multisite installations, administrators may also be able to exploit it because they lack unfiltered_html.

Q: When does the injected script execute?

The payload is stored in the image-alt field and executes when a user visits any page containing an affected [oxilab_flip_box] shortcode or block. The affected rendering paths include styles 18, 19, 20, 22, 25, and 29.

Q: How can I check whether a site may already contain an exploit payload?

Review Flipbox content using affected styles for image-alt values associated with the flip-box-image-upload-url-01-alt parameter, especially content edited by delegated contributors or multisite administrators. Suspicious values may contain double quotes or attribute-breaking HTML/script content.

Published Nov 7, 2026

Updated

The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitizetextfield() in Inc/Style22::registerchild() (and Inc/Style18, 19, 20, 25, 29) — which preserves the double-quote character — and then concatenating the stored value into a double-quoted HTML attribute in PublicRender/Style22::defaultrender() (and the corresponding Style18/19/20/25/29 renderers) with no escattr() escaping. This makes it possible for authenticated attackers, with contributor-level access and above (when an administrator has delegated the plugin's 'Who can edit' capability via the plugin Settings page, or on multisite installations where even administrators lack unfilteredhtml), to inject arbitrary web scripts in pages that will execute whenever a user accesses any page containing an affected [oxilabflipbox] shortcode or block.

Event History

Nov 7, 2026

CVE Published

via MITRE·12:27 PM

Data Sourced

via MITRE·12:27 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which WordPress sites are realistically exposed to contributor-level exploitation?

Exploitation requires a contributor or higher account to have the plugin's editing capability. This can occur when an administrator delegates the plugin's “Who can edit” capability in its Settings page; on multisite installations, administrators may also be able to exploit it because they lack unfiltered_html.

When does the injected script execute?

The payload is stored in the image-alt field and executes when a user visits any page containing an affected [oxilab_flip_box] shortcode or block. The affected rendering paths include styles 18, 19, 20, 22, 25, and 29.

How can I check whether a site may already contain an exploit payload?

Review Flipbox content using affected styles for image-alt values associated with the flip-box-image-upload-url-01-alt parameter, especially content edited by delegated contributors or multisite administrators. Suspicious values may contain double quotes or attribute-breaking HTML/script content.

CVE-2026-109973: Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter

Event History

Frequently Asked Questions

Which WordPress sites are realistically exposed to contributor-level exploitation?

When does the injected script execute?

How can I check whether a site may already contain an exploit payload?

Company

Resources

Contact

Frequently Asked Questions

Which WordPress sites are realistically exposed to contributor-level exploitation?

When does the injected script execute?

How can I check whether a site may already contain an exploit payload?