CVE-2021-25031

6.1 mediumEPSS 0.9%

Medium (6.1) in oxilab image hover effects ultimate. EPSS 0.9% chance of exploitation in the next 30 days.

The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-01-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

oxilab:image_hover_effects_ultimate

References

https://plugins.trac.wordpress.org/changeset/2648086
https://wpscan.com/vulnerability/1fbcf5ec-498e-4d40-8577-84b8c7ac3201
https://plugins.trac.wordpress.org/changeset/2648086
https://wpscan.com/vulnerability/1fbcf5ec-498e-4d40-8577-84b8c7ac3201

Check your stack JSON