Stored cross-site scripting in Flipbox WordPress plugin via image alt field
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Flipbox plugin (Awesomes Flip Boxes Image Overlay) for WordPress, also known as Image Hover Effects Ultimate Visual Composer, is affected in versions up to and including 3.1.1. The image alt field is saved with sanitize_text_field(), which keeps double-quote characters, and is output inside a double-quoted HTML attribute without escaping, which is CWE-79 stored cross-site scripting. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages containing the [oxilab_flip_box] shortcode or block, and the scripts run when any user visits those pages.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitize_text_field() in Inc/Style22::register_child() (and Inc/Style18, 19, 20, 25, 29) — which preserves the double-quote character — and then concatenating the stored value into a double-quoted HTML attribute in Public_Render/Style22::default_render() (and the corresponding Style18/19/20/25/29 renderers) with no esc_attr() escaping. This makes it possible for authenticated attackers, with contributor-level access and above (when an administrator has delegated the plugin's 'Who can edit' capability via the plugin Settings page, or on multisite installations where even administrators lack unfiltered_html), to inject arbitrary web scripts in pages that will execute whenever a user accesses any page containing an affected [oxilab_flip_box] shortcode or block.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Biplob Adhikari | Flipbox – Awesomes Flip Boxes Image Overlay | up to 3.1.1 | — | No fix listed | CNA |
- Flipbox – Awesomes Flip Boxes Image Overlay VendorBiplob Adhikari Affected up to 3.1.1 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for the Flipbox plugin (Awesomes Flip Boxes Image Overlay).
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Timeline
- 2026-11-07 Threatist record created from CVE-2026-109973
- 2026-11-07 Alias added: GHSA-fpcq-c836-79mc
- 2026-11-07 CISA SSVC decision points changed
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c3403cd6-31ba-4c36-a60e-d3e5c038af78?source=cve
- https://plugins.trac.wordpress.org/browser/image-hover-effects-ultimate-visual-composer/tags/3.1.0/Public_Render/Style22.php#L58
- https://plugins.trac.wordpress.org/browser/image-hover-effects-ultimate-visual-composer/tags/3.1.0/Inc/Style22.php#L169
- https://plugins.trac.wordpress.org/browser/image-hover-effects-ultimate-visual-composer/tags/3.1.0/Page/Admin_Render.php#L128
- https://plugins.trac.wordpress.org/browser/image-hover-effects-ultimate-visual-composer/tags/3.1.0/Includes/Admin/Menu.php#L53
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3762680%40image-hover-effects-ultimate-visual-composer&new=3762680%40image-hover-effects-ultimate-visual-composer
More Biplob Adhikari vulnerabilities
- TI-2021-14977 Improper access control in Biplob Adhikari Image Hover Effects Ultimate CVSS 3.1CRITICAL 9.8
- TI-2022-15381 WordPress Shortcode Addons plugin <= 3.0.2 - Unauthenticated Arbitrary Option Update vulnerability CVSS 3.1CRITICAL 9.8
- TI-2022-14629 WordPress Accordions plugin <= 2.0.2 - Unauthenticated WordPress Options Change vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-20503 WordPress Shortcode Addons <= 3.2.5 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.1
- TI-2022-17812 WordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability CVSS 3.1HIGH 7.2
- TI-2022-16714 WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability CVSS 3.1HIGH 7.2
Sources
- CVE-2026-109973 · CVE Program
- CVE-2026-109973 · NVD
- GHSA-fpcq-c836-79mc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences