---
id: "CVE-2026-109973"
page: "https://infrastack.ai/live/CVE-2026-109973"
kind: "vulnerability"
aliases: ["CVE-2026-109973"]
title: "WordPress Image Hover Effects plugin: stored XSS via flip box image alt field"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-contributor-edit-access", "plugin-not-installed", "single-site-unfiltered-html"]
published_at: "2026-11-07T13:16:33+00:00"
first_seen_at: "2026-11-07T13:47:25+00:00"
updated_at: "2026-11-07T13:49:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109973", "first_seen_at": "2026-11-07T13:47:25+00:00"}]
exploit_sources: []
---

# WordPress Image Hover Effects plugin: stored XSS via flip box image alt field

Link for people: https://infrastack.ai/live/CVE-2026-109973 (this .md is for agents)

The Image Hover Effects Ultimate Visual Composer WordPress plugin up to and including 3.1.1 saves the image alt attribute without escaping it into an HTML attribute. An authenticated contributor-level user can store a script that runs in the browser of any visitor to a page containing the affected shortcode or block.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the plugin named Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) in the WordPress admin plugin list, or in `wp-content/plugins/`
- Look for pages using the `[oxilab_flip_box]` shortcode or block
- Check whether contributors have been given the plugin's 'Who can edit' capability in its Settings page

## Timeline

- 2026-11-07T13:47:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109973

## From the sources

The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitize_text_field() in Inc/Style22::register_child() (and Inc/Style18, 19, 20, 25, 29) — which preserves the double-quote character — and then concatenating the stored value into a double-quoted HTML attribute in Public_Render/Style22::default_render() (and the corresponding Style18/19/20/25/29 renderers) with no esc_attr() escaping. This makes it possible for authenticated attackers, with contributor-level access and above (when an administrator has delegated the plugin's 'Who can edit' capability via the plugin Settings page, or on multisite installations where even administrators lack unfiltered_html), to inject arbitrary web scripts in pages that will execute whenever a user accesses any page containing an affected [oxilab_flip_box] shortcode or block.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_