The Flipbox Addon for Elementor plugin for WordPress contains a stored cross‑site scripting vulnerability. Unvalidated custom attribute names in the widget’s button URL field allow an attacker with author‑level or higher access to embed malicious scripts. The injected code is stored in the page and will execute in the browsers of all users who view the affected page, potentially compromising credentials, defacing content, or facilitating further attacks. The weakness stems from using esc_html() on the attribute name, which does not filter event‑handler attributes such as onmouseover or onclick.

WordPress sites that have the Flipbox Addon for Elementor plugin version 2.1.1 or earlier installed. The affected vendor is dragwyb, and the vulnerability applies to all releases up to and including 2.1.1.

The flaw has a CVSS score of 6.4, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access at author level or higher; once the attacker supplies malicious attributes, the script is persisted and will run whenever an affected page is accessed by any user. Because the vulnerability is stored, repeated exposure can amplify the impact. Prompt remediation is advised to prevent untrusted content from being rendered.