{
 "id": "WPSEC-2026-3035",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3035/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3035/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3035/index.md",
 "title": "Flipbox <= 1.4.1 - Authenticated (Contributor+) CSS Injection via Block Style Attributes",
 "description": "The Flipbox plugin for WordPress is vulnerable to CSS Injection via block style attributes (blockMeta, commonStyles and customCss) in all versions up to, and including, 1.4.1, due to insufficient sanitization of block CSS before it is written to the post's public stylesheet. Versions before 1.4.1 write this CSS without any filtering. In 1.4.1 the filter can be bypassed with CSS comments, non-hex CSS escapes and an unclosed url() at the end of the CSS. This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary CSS, including off-site url() loads, into pages that load the stylesheet. That CSS can deface pages and use attribute selectors to send page data to a host the attacker controls.",
 "plugin": {
  "slug": "flipbox",
  "name": "Flipbox",
  "full_name": "Flipbox",
  "wordpress_org": "https://wordpress.org/plugins/flipbox/",
  "advisories_url": "https://wpsec.com/vuln/plugin/flipbox/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/flipbox"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-74"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.2.2",
    "from_inclusive": true,
    "to": "1.4.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.2.2 before 1.4.2"
  ]
 },
 "introduced_in": "1.2.2",
 "fixed_in": "1.4.2",
 "remediation": "Update to 1.4.2 or later.",
 "fix_released": "2026-11-12T08:54:12+00:00",
 "published": "2026-11-13T09:43:21+00:00",
 "updated": "2026-11-12T17:15:24.879674+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3035/",
  "https://plugins.svn.wordpress.org/flipbox/tags/1.4.2/",
  "https://wordpress.org/plugins/flipbox/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/flipbox",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}