CVE-2026-109973

Name of the Vulnerable Software and Affected Versions Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) versions prior to 3.1.2

Description Stored Cross-Site Scripting occurs via the flip-box-image-upload-url-01-alt parameter. The issue arises because the plugin uses sanitize text field() in functions such as Inc/Style22::register child() (and styles 18, 19, 20, 25, 29), which preserves double-quote characters. These values are subsequently concatenated into double-quoted HTML attributes in Public Render/Style22::default render() (and corresponding renderers for styles 18, 19, 20, 25, 29) without esc attr() escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user visits any page containing an affected [oxilab flip box] shortcode or block.

Recommendations Update to a version newer than 3.1.1.