Vulnerability in Flipbox – Awesomes Flip Boxes Image Overlay — CVE-2026-109973

MediumSeverity
CVSS 6.4

—Estimated exploit probability
EPSS

10,000+ sitesInstalls

3.1.2Fixed in

What to do now

Update Flipbox – Awesomes Flip Boxes Image Overlay to 3.1.2 or later.

Affected versions

Everything up to and including 3.1.1

Affected: Flipbox – Awesomes Flip Boxes Image Overlay (plugin, image-hover-effects-ultimate-visual-composer)

Check: The plugin on wordpress.org / Our record for Flipbox – Awesomes Flip Boxes Image Overlay

The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitize_text_field() in Inc/Style22::register_child() (and Inc/Style18, 19, 20, 25, 29) — which preserves the double-quote character — and then concatenating the stored value into a double-quoted HTML attribute in Public_Render/Style22::default_render() (and the corresponding Style18/19/20/25/29 renderers) with no esc_attr() escaping. This makes it possible for authenticated attackers, with contributor-level access and above (when an administrator has delegated the plugin's 'Who can edit' capability via the plugin Settings page, or on multisite installations where even administrators lack unfiltered_html), to inject arbitrary web scripts in pages that will execute whenever a user accesses any page containing an affected [oxilab_flip_box] shortcode or block.

This description is reproduced verbatim from the public vulnerability record.

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.

Vulnerability in Flipbox – Awesomes Flip Boxes Image Overlay — CVE-2026-109973

What to do now

What the vulnerability is

Sources