PT-2026-33589 · WordPress · Flipbox Addon For Elementor

Athiwat Tiprasaharn + 1 · Published 2026-04-18 · Updated 2026-04-18 · CVE-2026-6048

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flipbox Addon for Elementor versions prior to 2.1.2

Description Insufficient validation of custom attribute names in the Flipbox widget's button URL custom attributes field allows authenticated attackers with author-level access and above to inject arbitrary web scripts. The plugin uses esc html() on the attribute name, which fails to prevent the use of event handler attributes such as onmouseover or onclick. These scripts execute whenever a user accesses an affected page.

Recommendations Update to a version later than 2.1.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-6048

Affected Products

Flipbox Addon For Elementor

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-6048 · Security Note
• https://twitter.com/CVEnew/status/2045467321922179245 · Twitter Post
• https://plugins.trac.wordpress.org/browser/ultimate-flipbox-addon-for-elementor/tags/2.1.2/widget/simple/ufae-frontend/class-ufae-frontend-item.php#L263 · Note
• https://twitter.com/VulmonFeeds/status/2045396277915976028 · Twitter Post
• https://plugins.trac.wordpress.org/browser/ultimate-flipbox-addon-for-elementor/tags/2.1.2/widget/stories/ufae-frontend/class-ufae-frontend-loop.php#L253 · Note
• https://plugins.trac.wordpress.org/browser/ultimate-flipbox-addon-for-elementor/tags/2.1.1/widget/stories/ufae-frontend/class-ufae-frontend-loop.php#L248 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/faa6ad51-7b3b-4fe1-95fa-e9b63943d533?source=cve · Note
• https://plugins.trac.wordpress.org/browser/ultimate-flipbox-addon-for-elementor/tags/2.1.1/widget/simple/ufae-frontend/class-ufae-frontend-item.php#L250 · Note