Stored Cross-Site Scripting in Image Hover Effects Ultimate Plugin for WordPress

CVE-2022-4207

Summary

The Image Hover Effects Ultimate plugin for WordPress exposes a vulnerability that allows stored cross-site scripting through various values added to Image Hovers in versions 9.8.1 to 9.8.4. This weakness arises from inadequate input sanitization and output escaping, permitting authenticated attackers to inject malicious web scripts into pages. When a user accesses an infected page, the injected scripts execute, potentially compromising user data or site functionality. Although the feature is intended only for admin use, if an admin mistakenly grants lower-privileged users access via the 'Who Can Edit?' setting, it creates an avenue for exploitation.

References