Skip to content
OpenAdvisories

Vendor

oxilab

5 known vulnerabilities.

Products

Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) 2 Image Hover Effects Ultimate (WordPress plugin) 1 Product Layouts for WooCommerce 1 Flipbox – Awesomes Flip Boxes Image Overlay 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-109973

    Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter

    The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This…

    oxilab Flipbox – Awesomes Flip Boxes Image Overlay Web / CMS
  • Medium 4.9
    CVE-2026-118056

    Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) <= 9.12.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'oxi_image_comparison_before_text' Parameter

    The Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rawdata.oxi_image_comparison_before_text' parameter in all versions up to, and including, …

    oxilab Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) Web / CMS
  • Medium 6.1
    CVE-2024-13362

    Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

    Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject …

    bPlugins webfactory unitecms nicheaddons Web / CMS
  • Medium 6.4
    CVE-2025-5092

    Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library

    Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. Thi…

    wproyal vowelweb famethemes oxilab Web / CMS