Stored Cross-Site Scripting Vulnerability in Image Hover Effects Ultimate Plugin for WordPress

CVE-2026-118056

What is CVE-2026-118056?

The Image Hover Effects Ultimate plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate sanitization of user input and improper output escaping. This flaw allows authenticated users with subscriber-level access or higher to inject malicious scripts into web pages through the 'rawdata.oxi_image_comparison_before_text' parameter. This vulnerability can be exploited under specific conditions where the plugin's configuration permits subscriber-level users to modify existing style IDs, potentially leading to the execution of harmful scripts when other users view the affected pages.

References