Security Alert Summary
The Flipbox Addon for Elementor plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the Flipbox widget’s button URL custom_attributes field. Insufficient validation of custom attribute names allows authenticated users with author-level access or higher to inject attributes such as event handlers (for example, onclick), which can result in arbitrary script execution when a page with the injected content is viewed.
CVE Details
- CVE ID: CVE-2026-6048
- Affected component: Flipbox Addon for Elementor plugin (Flipbox widget’s button URL
custom_attributesfield) - Affected versions: All versions up to, and including, 2.1.1
- Published: April 18, 2026 at 5:16:24 AM UTC
- Last modified: April 18, 2026 at 5:16:24 AM UTC
- CVSS v3.1 base score: 6.4
- Severity: MEDIUM
- Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction: Requires an authenticated user with low privileges (author-level access or higher). No user interaction is required for the vulnerability to be triggered once malicious content is present.
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting)
Technical Details
The plugin fails to properly validate custom attribute names provided in the Flipbox widget’s button URL custom_attributes field. The code applies esc_html() to the attribute name, which escapes HTML but does not prevent or remove event handler attributes such as onmouseover or onclick. As a result, an authenticated user with author-level access or higher can store attribute names that act as event handlers, allowing arbitrary JavaScript to be embedded and executed when a visitor loads the affected page.
This is a stored XSS vulnerability: malicious input is saved by the application and later rendered in pages viewed by other users. The description and available code references indicate the insufficient validation of attribute names is the root cause. The issue does not require additional user interaction to execute beyond viewing an injected page.
How This Could Impact Your Website
Consider a small business site where the owner delegates content creation to an internal editor and occasionally to an external contractor. An author-level user could insert a malicious custom attribute into a Flipbox button URL field on a commonly visited page. When other staff, contributors, or site visitors open that page, the injected script can run in the context of their browser sessions.
- Internal staff or contractors who view the page could have page content altered or be redirected by injected scripts.
- Scripts could be used to harvest data visible to the page (for example, user-visible information) or to display deceptive content to facilitate targeted phishing or social engineering against staff or customers.
- Because the attack is stored, multiple users can be affected over time whenever the injected page is accessed.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and author roles.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and page content for unusual changes or unexpected script injection.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/ultimate-flipbox-addon-for-elementor/tags/2.1.1/widget/simple/ufae-frontend/class-ufae-frontend-item.php#L250
- https://plugins.trac.wordpress.org/browser/ultimate-flipbox-addon-for-elementor/tags/2.1.1/widget/stories/ufae-frontend/class-ufae-frontend-loop.php#L248
- https://plugins.trac.wordpress.org/browser/ultimate-flipbox-addon-for-elementor/tags/2.1.2/widget/simple/ufae-frontend/class-ufae-frontend-item.php#L263
- https://plugins.trac.wordpress.org/browser/ultimate-flipbox-addon-for-elementor/tags/2.1.2/widget/stories/ufae-frontend/class-ufae-frontend-loop.php#L253
- https://www.wordfence.com/threat-intel/vulnerabilities/id/faa6ad51-7b3b-4fe1-95fa-e9b63943d533?source=cve
