CVE-2026-109973— Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter

Quick assessment

Affected

oxilab Flipbox – Awesomes Flip Boxes Image Overlay

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件"Image Hover Effects Ultimate Visual Composer（Flipbox - Awesomes Flip Boxes Image Overlay）”在 3.1.1 及更早版本中存在存储型跨站脚本（Stored XSS）漏洞。该漏洞源于插件在（以及、、、、）中，通过函数保存图像替代文本（image-alt）字段；该函数会保留双引号字符。随后，在（以及对应的、、、、渲染器）中，插件将已保存的值直接拼接到双引号包裹的 HTML 属性中，且

CVSS 6.4 · Medium Updated Nov 07, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter

Source: CVE Program / CVE List V5

Vulnerability Description

The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitize_text_field() in Inc/Style22::register_child() (and Inc/Style18, 19, 20, 25, 29) — which preserves the double-quote character — and then concatenating the stored value into a double-quoted HTML attribute in Public_Render/Style22::default_render() (and the corresponding Style18/19/20/25/29 renderers) with no esc_attr() escaping. This makes it possible for authenticated attackers, with contributor-level access and above (when an administrator has delegated the plugin's 'Who can edit' capability via the plugin Settings page, or on multisite installations where even administrators lack unfiltered_html), to inject arbitrary web scripts in pages that will execute whenever a user accesses any page containing an affected [oxilab_flip_box] shortcode or block.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
oxilab	Flipbox – Awesomes Flip Boxes Image Overlay	0 ~ 3.1.1	-

II. Public POCs for CVE-2026-109973

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-109973

请登录查看更多情报信息。

Other References for CVE-2026-109973 (6)

https://www.cve.org/CVERecord?id=CVE-2026-109973

IV. Related Vulnerabilities

Same vendor: oxilab

Same weakness: CWE-79