EUVD-2026-23652Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Flipbox Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flipbox widget's button URL custom_attributes field in all versions up to, and including, 2.1.1 due to insufficient validation of custom attribute names. Specifically, the plugin uses esc_html() on the attribute name which does not prevent event handler attributes (e.g., onmouseover, onclick). This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored XSS in Flipbox Addon for Elementor WordPress plugin (versions ≤2.1.1) allows authenticated authors to inject malicious scripts via the button URL custom_attributes field due to insufficient validation of attribute names. The vulnerability uses esc_html() on attribute names, which fails to block event handler attributes like onmouseover and onclick, enabling arbitrary JavaScript execution in pages viewed by any user. CVSS 6.4 reflects the requirement for authenticated author-level access, but the stored nature and cross-site scope increase practical risk. Patch available in version 2.1.2.
Technical ContextAI
The Flipbox Addon for Elementor is a WordPress plugin that extends the Elementor page builder with flipbox widgets. The vulnerability exists in the widget's button URL rendering logic, specifically in the custom_attributes field used to inject HTML attributes into button elements. The plugin attempts to sanitize attribute names using WordPress's esc_html() function, which escapes HTML special characters (<, >, &, etc.) but does NOT prevent or filter event handler attribute names. The CWE-79 (Improper Neutralization of Input During Web Page Generation) root cause is that the sanitization approach is context-inappropriate: esc_html() is designed for escaping text content within HTML tags, not for validating or filtering attribute names themselves. An attacker can supply attribute names like 'onmouseover' or 'onclick' that, while not containing special characters, are recognized by browsers as event handlers. The vulnerable code is located in class-ufae-frontend-item.php and class-ufae-frontend-loop.php, which render button attributes without a whitelist of allowed attribute names or proper validation to reject event handler patterns. CPE cpe:2.3:a:dragwyb:flipbox_addon_for_elementor identifies the affected plugin across all versions.
RemediationAI
Update Flipbox Addon for Elementor to version 2.1.2 or later immediately. This patch version contains fixes to the custom_attributes validation logic, likely implementing a whitelist of safe HTML attributes and/or filtering event handler attribute names. WordPress administrators should navigate to Plugins → Installed Plugins, locate 'Ultimate Flipbox Addon for Elementor' (or 'Flipbox Addon for Elementor'), and click 'Update Now' to deploy version 2.1.2+. If automatic updates are not enabled, manually download the latest version from the WordPress.org plugin repository and reinstall. No workarounds are available for versions prior to 2.1.2 that fully mitigate the risk without disabling the custom_attributes feature. As an interim compensating control with significant limitations, site administrators can restrict author-level capabilities to trusted users only and audit existing posts/pages for suspicious custom attribute values containing 'on' event handlers (e.g., searching page content for patterns like 'onload=', 'onclick=', 'onmouseover='). However, this approach does NOT prevent future injection and should be considered temporary only. Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/faa6ad51-7b3b-4fe1-95fa-e9b63943d533?source=cve contains additional remediation guidance.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today