oxilab vulnerabilities and threats

The Flipbox – Awesomes Flip Boxes Image Overlay WordPress plugin versions up to 3.1.1 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of the 'flip-box-image-upload-url-01-alt' parameter, allowing authenticated users with contributor-level access or higher to inject malicious scripts. Exploitation requires specific permission configurations, such as delegated editing capabilities or multisite setups with restricted unfiltered_html. The vulnerability can lead to script execution in any page containing the affected shortcode or block.

The Image Hover Effects Ultimate WordPress plugin (up to version 9.12.2) contains a stored cross-site scripting (XSS) vulnerability via the 'rawdata.oxi_image_comparison_before_text' parameter. This flaw allows authenticated users with subscriber-level access or higher to inject arbitrary scripts if the plugin's "Who can edit" setting is configured to allow subscribers to edit styles. The vulnerability arises from insufficient input sanitization and missing ownership checks on style IDs, enabling script execution when affected pages are viewed.