Cross-site Scripting Vulnerability in Hover Image Button Plugin by Ignacio Perez
CVE-2025-27266

6.5MEDIUM

Key Information:

Vendor
Ignacio Perez
Status
Hover Image Button
Vendor
CVE Published:
24 February 2025

Summary

The Hover Image Button plugin, developed by Ignacio Perez, contains a vulnerability that allows for cross-site scripting (XSS) through improper handling of user input during web page generation. This issue can lead to DOM-based XSS attacks, allowing attackers to execute harmful scripts in the context of users accessing the affected versions of the plugin, specifically versions up to 1.1.2. Proper validation and sanitization of input are essential to thwart these exploits and protect your website from potential threats.

Affected Version(s)

Hover Image Button <= 1.1.2

References

https://patchstack.com/database/wordpress/plugin/hover-im...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

muhammad yudha (Patchstack Alliance)
.