CVE-2026-109973: 
WordPress vulnerability analysis and mitigation

CVE-2026-109973 is a Stored Cross-Site Scripting (XSS) vulnerability in the Image Hover Effects Ultimate Visual Composer (Flipbox – Awesomes Flip Boxes Image Overlay) plugin for WordPress, affecting versions up to and including 3.1.1. The flaw resides in the flip-box-image-upload-url-01-alt parameter, where the image-alt field is improperly sanitized and rendered without HTML attribute escaping. It was published on November 7, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin saves the image-alt field using WordPress's sanitize_text_field() function in Inc/Style22::register_child() (and Style18, 19, 20, 25, 29), which strips tags but preserves double-quote characters. The stored value is then concatenated directly into a double-quoted HTML attribute in Public_Render/Style22::default_render() (and corresponding renderers) without applying esc_attr() escaping, allowing an attacker to break out of the attribute context and inject arbitrary JavaScript. Exploitation requires authenticated access at contributor level or above, or occurs on multisite installations where administrators lack the unfiltered_html capability (GitHub Advisory).

Successful exploitation allows authenticated attackers to persistently inject arbitrary JavaScript into any WordPress page containing an [oxilab_flip_box] shortcode or block. The injected scripts execute in the browsers of all users who visit affected pages, enabling session hijacking, credential theft, defacement, or redirection to malicious sites. Both confidentiality and integrity are impacted at a low level per CVSS scoring, with no direct availability impact; however, the scope change (S:C) indicates the attack can affect resources beyond the vulnerable component itself (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires authenticated access (contributor-level or above), which limits the attack surface compared to unauthenticated flaws. No threat actor attribution has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is not publicly available in the current data (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Image Hover Effects Ultimate Visual Composer (Flipbox) plugin at version 3.1.1 or earlier, and confirm that the attacker has contributor-level (or higher) access, or that the administrator has delegated the plugin's 'Who can edit' capability.
2. Craft malicious payload: Prepare a payload that breaks out of a double-quoted HTML attribute context, such as " onmouseover="alert(document.cookie) or a more sophisticated script tag injection.
3. Inject via alt text field: When editing or creating a flip box element, insert the crafted payload into the flip-box-image-upload-url-01-alt (image alt text) field and save the shortcode or block.
4. Persistence: The malicious value is stored in the WordPress database via sanitize_text_field(), which does not strip double quotes, making the payload persistent.
5. Trigger execution: Any user (including unauthenticated visitors) who loads a page containing the affected [oxilab_flip_box] shortcode or block will have the injected script execute in their browser, enabling session theft, phishing, or further attacks (GitHub Advisory).

• Database: WordPress wp_posts or wp_postmeta entries for flip box shortcodes containing unexpected double-quote sequences or JavaScript event handlers (e.g., onmouseover=, onerror=, <script>) within alt text fields associated with [oxilab_flip_box] shortcodes.
• Logs: WordPress audit logs or server access logs showing POST requests to the flip box editor endpoint by contributor-level accounts, particularly with unusual characters (", >, <script) in the alt text parameter.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages with flip box content, potentially indicating data exfiltration (e.g., cookie theft via document.location redirects).
• File System: No direct file system artifacts expected, as the payload is stored in the database rather than written to disk (GitHub Advisory).

Update the Image Hover Effects Ultimate Visual Composer plugin to a version released after 3.1.1, which addresses the missing esc_attr() escaping in the affected renderers. As a workaround, administrators should restrict the plugin's 'Who can edit' capability in the plugin Settings page to trusted roles only, and avoid granting contributor-level users access to flip box content on sensitive sites. On multisite installations, enforce proper capability restrictions. Administrators should also audit existing flip box shortcodes and blocks for suspicious alt text content that may already contain injected scripts (GitHub Advisory).