Medium severity · published Jan 24, 2022
CVE-2021-25031
The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting…
6.1
CVSS
0.9%
EPSS
No
On KEV
Description
The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IH
Image Hover Effects Ultimate · Oxilab
before 9.7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-25031
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-25031
Patch
https://plugins.trac.wordpress.org/changeset/2648086
Exploit
https://wpscan.com/vulnerability/1fbcf5ec-498e-4d40-8577-84b8c7ac3201
More from Image Hover Effects Ultimate
7.2
CVE-2022-42459
Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress
5.4
CVE-2022-4207
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to…
5.4
CVE-2022-2937
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Description values that can be added to an Image Hover in…
5.4
CVE-2022-2936
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Video Link values that can be added to an Image Hover in versions up to, and…
5.4
CVE-2022-2935
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media Image URL value that can be added to an Image Hover in versions up…