CVE-2022-2937

CVE-2022-2937 — WordPress Image Hover Effects Ultimate is affected by a stored XSS vulnerability in the Image Hover feature. The issue stems from insufficient input sanitization and output escaping for the Title and Description fields when creating Image Hovers, enabling authenticated (low privil...

CVE-2021-25031

The CVE concerns WordPress plugin Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) versions before 9.7.1. The root cause is failure to escape the effects parameter when echoed into an attribute on an admin page, enabling a Reflected Cross-Site Scripting (XS...