CVE-2022-4207 - The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping

Back Back to CVE browser

MEDIUM

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping

Published Dec 13, 2022

5.5

MEDIUM

CVSS 3.1

EPSS 0.55%

Description

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.

Affected products

Vendor Biplob018 Product n/a Default
unaffected
- Version
  9.8.1
  Status
  affected
  Constraints
  <=9.8.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Biplob018

n/a

unaffected

Version	Status	Constraints
9.8.1	affected	<=9.8.4

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

https://github.com/MrOxizen/image-hover-effects-ultimate/commit/4ba784e1a2a0cf02e8b8cbe3db7323735d7dedc9
PatchThird Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2830197%40image-hover-effects-ultimate&new=2830197%40image-hover-effects-ultimate&sfp_email=&sfph_mail=
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/f00cdef3-d733-4e85-8099-204ef76096b4
Third Party Advisory

Link	Providers	Tags
https://github.com/MrOxizen/image-hover-effects-ultimate/commit/4ba784e1a2a0cf02e8b8cbe3db7323735d7dedc9		PatchThird Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2830197%40image-hover-effects-ultimate&new=2830197%40image-hover-effects-ultimate&sfp_email=&sfph_mail=		Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/f00cdef3-d733-4e85-8099-204ef76096b4		Third Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Wordfence

Published Dec 13, 2022

Updated Jan 23, 2025

Reserved Nov 29, 2022

Link CVE-2022-4207

CISA Vulnrichment

Updated Jan 23, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-4207

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-4207