Stored Cross-Site Scripting Vulnerability in Flipbox Addon for Elementor by WordPress

CVE-2026-6048

What is CVE-2026-6048?

The Flipbox Addon for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability due to inadequate validation of custom attribute names in the button URL's custom_attributes field. This flaw allows authenticated users with author-level access or higher to inject malicious scripts into web pages. The vulnerability stems from the use of esc_html() on attribute names, which fails to sanitize event handler attributes like onmouseover and onclick. As a result, when users visit an affected page, the injected scripts execute, potentially leading to data theft or site compromise.

References