CVE-2021-25031 Image Hover Effects Ultimate < 9.7.1 - Reflected Cross-Site Scripting

2022-01-2408:01:14

CWE-79

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

30.1%

JSON

The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

CNA Affected

[
  {
    "product": "Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier)",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "9.7.1",
        "status": "affected",
        "version": "9.7.1",
        "versionType": "custom"
      }
    ]
  }
]