{"id":"CVE-2026-109973","kind":"vulnerability","aliases":["CVE-2026-109973"],"related":[],"title":"WordPress Image Hover Effects plugin: stored XSS via flip box image alt field","description":"The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitize_text_field() in Inc/Style22::register_child() (and Inc/Style18, 19, 20, 25, 29) — which preserves the double-quote character — and then concatenating the stored value into a double-quoted HTML attribute in Public_Render/Style22::default_render() (and the corresponding Style18/19/20/25/29 renderers) with no esc_attr() escaping. This makes it possible for authenticated attackers, with contributor-level access and above (when an administrator has delegated the plugin's 'Who can edit' capability via the plugin Settings page, or on multisite installations where even administrators lack unfiltered_html), to inject arbitrary web scripts in pages that will execute whenever a user accesses any page containing an affected [oxilab_flip_box] shortcode or block.","summary":"The Image Hover Effects Ultimate Visual Composer WordPress plugin up to and including 3.1.1 saves the image alt attribute without escaping it into an HTML attribute. An authenticated contributor-level user can store a script that runs in the browser of any visitor to a page containing the affected shortcode or block.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-contributor-edit-access","plugin-not-installed","single-site-unfiltered-html"],"how_to_check":"- Check the installed version of the plugin named Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) in the WordPress admin plugin list, or in `wp-content/plugins/`\n- Look for pages using the `[oxilab_flip_box]` shortcode or block\n- Check whether contributors have been given the plugin's 'Who can edit' capability in its Settings page","fix":null,"status":"open","published_at":"2026-11-07T13:16:33+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","triaged_at":"2026-11-07T13:49:22+00:00","updated_at":"2026-11-07T13:49:22+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T13:49:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Image Hover Effects plugin: stored XSS via flip box image alt field","impact":"medium","summary":"The Image Hover Effects Ultimate Visual Composer WordPress plugin up to and including 3.1.1 saves the image alt attribute without escaping it into an HTML attribute. An authenticated contributor-level user can store a script that runs in the browser of any visitor to a page containing the affected shortcode or block.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker script runs in visitors' browsers, stealing sessions or actions","analyst_note":"Confirm the fixed version from the WordPress plugin changelog or the Wordfence/NVD entry; the sources here give no fixed version.","how_to_check":"- Check the installed version of the plugin named Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) in the WordPress admin plugin list, or in `wp-content/plugins/`\n- Look for pages using the `[oxilab_flip_box]` shortcode or block\n- Check whether contributors have been given the plugin's 'Who can edit' capability in its Settings page","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-contributor-edit-access","single-site-unfiltered-html"],"who_is_affected":"Sites running this WordPress plugin at version 3.1.1 or earlier that let contributor-level or higher users edit flip box content, or that run multisite where administrators lack unfiltered HTML rights. Sites that do not use the plugin, or where only trusted administrators can edit its content, are less exposed. The sources do not name a fixed version.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000804,"input_tokens":4536,"output_tokens":700,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109973':16A,19A '-2026':15A,18A '01':113C '19':145C '20':146C '25':147C '29':148C '3.1.1':41B,122C 'access':195C,238C 'administr':200C,221C 'affect':77B,243C 'alt':12A,45B,114C,133C 'arbitrari':227C 'attack':190C 'attr':182C 'attribut':46B,53B,168C 'authent':55B,189C 'awesom':89C 'block':80B,249C 'box':10A,91C,109C,246C 'browser':68B 'capabl':209C 'charact':155C 'child':142C 'compos':34B,87C 'concaten':158C 'contain':75B,241C 'contributor':57B,193C 'contributor-level':56B,192C 'correspond':176C 'cross':102C 'cross-sit':101C 'cve':14A,17A 'default':172C 'deleg':202C 'doubl':153C,165C 'double-quot':152C,164C 'due':125C 'edit':208C 'effect':4A,31B,84C 'esc':181C 'escap':48B,183C 'even':220C 'execut':234C 'field':13A,134C,138C 'flip':9A,90C,108C,245C 'flip-box-image-upload-url':107C 'flipbox':88C 'host':23B 'hover':3A,30B,83C 'html':52B,167C,224C 'imag':2A,11A,29B,44B,82C,92C,110C,132C 'image-alt':131C 'inc/style18':144C 'inc/style22':140C 'includ':40B,121C 'inject':226C 'instal':218C 'lack':222C 'level':58B,194C 'make':185C 'multisit':217C 'overlay':93C 'oxilab':244C 'packag':20B 'page':74B,214C,231C,240C 'paramet':115C 'plugin':5A,27B,36B,94C,128C,204C,212C 'possibl':187C 'preserv':150C 'public':170C 'quot':154C,166C 'regist':141C 'render':173C,178C 'render/style22':171C 'run':65B 'sanit':136C 'save':42B,129C 'script':63B,104C,229C 'self':22B 'self-host':21B 'set':213C 'shortcod':78B,247C 'site':103C 'store':6A,61B,100C,160C 'style18/19/20/25/29':177C 'text':137C 'ultim':32B,85C 'unfilt':223C 'upload':111C 'url':112C 'user':59B,237C 'valu':161C 'version':117C 'via':8A,105C,210C 'visitor':71B 'visual':33B,86C 'vulner':98C 'web':228C 'whenev':235C 'without':47B 'wordpress':1A,24B,26B,35B,96C 'wordpress-plugin':25B 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running this WordPress plugin at version 3.1.1 or earlier that let contributor-level or higher users edit flip box content, or that run multisite where administrators lack unfiltered HTML rights. Sites that do not use the plugin, or where only trusted administrators can edit its content, are less exposed. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-109973':16A,19A '-2026':15A,18A 'alt':12A 'box':10A 'cve':14A,17A 'effect':4A 'field':13A 'flip':9A 'hover':3A 'imag':2A,11A 'plugin':5A 'store':6A 'via':8A 'wordpress':1A 'xss':7A","search_b":"'3.1.1':41B 'affect':77B 'alt':45B 'attribut':46B,53B 'authent':55B 'block':80B 'browser':68B 'compos':34B 'contain':75B 'contributor':57B 'contributor-level':56B 'effect':31B 'escap':48B 'host':23B 'hover':30B 'html':52B 'imag':29B,44B 'includ':40B 'level':58B 'packag':20B 'page':74B 'plugin':27B,36B 'run':65B 'save':42B 'script':63B 'self':22B 'self-host':21B 'shortcod':78B 'store':61B 'ultim':32B 'user':59B 'visitor':71B 'visual':33B 'without':47B 'wordpress':24B,26B,35B 'wordpress-plugin':25B","search_c":"'01':113C '19':145C '20':146C '25':147C '29':148C '3.1.1':122C 'access':195C,238C 'administr':200C,221C 'affect':243C 'alt':114C,133C 'arbitrari':227C 'attack':190C 'attr':182C 'attribut':168C 'authent':189C 'awesom':89C 'block':249C 'box':91C,109C,246C 'capabl':209C 'charact':155C 'child':142C 'compos':87C 'concaten':158C 'contain':241C 'contributor':193C 'contributor-level':192C 'correspond':176C 'cross':102C 'cross-sit':101C 'default':172C 'deleg':202C 'doubl':153C,165C 'double-quot':152C,164C 'due':125C 'edit':208C 'effect':84C 'esc':181C 'escap':183C 'even':220C 'execut':234C 'field':134C,138C 'flip':90C,108C,245C 'flip-box-image-upload-url':107C 'flipbox':88C 'hover':83C 'html':167C,224C 'imag':82C,92C,110C,132C 'image-alt':131C 'inc/style18':144C 'inc/style22':140C 'includ':121C 'inject':226C 'instal':218C 'lack':222C 'level':194C 'make':185C 'multisit':217C 'overlay':93C 'oxilab':244C 'page':214C,231C,240C 'paramet':115C 'plugin':94C,128C,204C,212C 'possibl':187C 'preserv':150C 'public':170C 'quot':154C,166C 'regist':141C 'render':173C,178C 'render/style22':171C 'sanit':136C 'save':129C 'script':104C,229C 'set':213C 'shortcod':247C 'site':103C 'store':100C,160C 'style18/19/20/25/29':177C 'text':137C 'ultim':85C 'unfilt':223C 'upload':111C 'url':112C 'user':237C 'valu':161C 'version':117C 'via':105C,210C 'visual':86C 'vulner':98C 'web':228C 'whenev':235C 'wordpress':96C","first_public_at":"2026-11-07T13:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109973","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109973","severity":null,"published_at":"2026-11-07T13:16:33+00:00","modified_at":"2026-11-07T13:16:34+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","fetched_at":"2026-11-07T13:47:25+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}