Image Hover Effects Ultimate <= 9.12.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comparison, Lightbox, Magnifier and Carousel Style Settings
- ID
- WPSEC-2026-2530
- Plugin
- Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) (image-hover-effects-ultimate)
- Affected
- from 9.3.2 before 9.12.3
- Remediation
- Update to 9.12.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- Image Hover Effects Ultimate on WPSec AttackSurface
- Fix released
- Published
Description
The Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Comparison, Lightbox, Magnifier and Carousel style settings in all versions up to, and including, 9.12.2. This is due to saved style values, such as the carousel effect, speed and slides-per-view values, comparison labels and offsets, magnifier sizes and lightbox media URLs, being concatenated unescaped into inline JavaScript. This makes it possible for authenticated attackers who have been given access to the plugin's style editor through the 'Who can edit' setting, which could be set as low as Subscriber, to inject arbitrary web scripts that execute whenever a user, including an administrator, views an affected page or the style editor. Exploitation requires the site to have given plugin access to a role without the unfiltered_html capability.
References
- https://wpsec.com/vuln/WPSEC-2026-2530/
- https://plugins.svn.wordpress.org/image-hover-effects-ultimate/tags/9.12.3/
- https://wordpress.org/plugins/image-hover-effects-ultimate/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS