Flipbox <= 1.4.1 - Authenticated (Contributor+) CSS Injection via Block Style Attributes
- ID
- WPSEC-2026-3035
- Plugin
- Flipbox (flipbox)
- Affected
- from 1.2.2 before 1.4.2
- Remediation
- Update to 1.4.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-74
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- Flipbox on WPSec AttackSurface
- Fix released
- Published
Description
The Flipbox plugin for WordPress is vulnerable to CSS Injection via block style attributes (blockMeta, commonStyles and customCss) in all versions up to, and including, 1.4.1, due to insufficient sanitization of block CSS before it is written to the post's public stylesheet. Versions before 1.4.1 write this CSS without any filtering. In 1.4.1 the filter can be bypassed with CSS comments, non-hex CSS escapes and an unclosed url() at the end of the CSS. This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary CSS, including off-site url() loads, into pages that load the stylesheet. That CSS can deface pages and use attribute selectors to send page data to a host the attacker controls.
References
- https://wpsec.com/vuln/WPSEC-2026-3035/
- https://plugins.svn.wordpress.org/flipbox/tags/1.4.2/
- https://wordpress.org/plugins/flipbox/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS