CVE-2026-109973 · Package
NO FIX YET
The Image Hover Effects Ultimate Visual Composer WordPress plugin up to and including 3.1.1 saves the image alt attribute without escaping it into an HTML attribute. An authenticated contributor-level user can store a script that runs in the browser of any visitor to a page containing the affected shortcode or block.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running this WordPress plugin at version 3.1.1 or earlier that let contributor-level or higher users edit flip box content, or that run multisite where administrators lack unfiltered HTML rights. Sites that do not use the plugin, or where only trusted administrators can edit its content, are less exposed. The sources do not name a fixed version.
Not affected if no-contributor-edit-access, plugin-not-installed, single-site-unfiltered-html
Who cares self-hosted, wordpress, wordpress-plugin
wp-content/plugins/[oxilab_flip_box] shortcode or blockNo fix yet, per the sources.
The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitize_text_field() in Inc/Style22::register_child() (and Inc/Style18, 19, 20, 25, 29) — which preserves the double-quote character — and then concatenating the stored value into a double-quoted HTML attribute in Public_Render/Style22::default_render() (and the corresponding Style18/19/20/25/29 renderers) with no esc_attr() escaping. This makes it possible for authenticated attackers, with contributor-level access and above (when an administrator has delegated the plugin's 'Who can edit' capability via the plugin Settings page, or on multisite installations where even administrators lack unfiltered_html), to inject arbitrary web scripts in pages that will execute whenever a user accesses any page containing an affected [oxilab_flip_box] shortcode or block.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.