PT-2021-21398 · Unknown · Image Hover Effects Ultimate

John Castro · Published 2021-12-15 · Updated 2025-12-01 · CVE-2021-36888

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Image Hover Effects Ultimate versions prior to 9.6.1

Description The issue is an Unauthenticated Arbitrary Options Update vulnerability. This vulnerability can lead to a full website compromise.

Recommendations For versions prior to 9.6.1, update to version 9.6.1 or later to resolve the issue.

Fix

Improper Access Control

Missing Authentication

Weakness Enumeration

CWE-284

CWE-306

Related Identifiers

CVE-2021-36888

Affected Products

Image Hover Effects Ultimate

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-36888 · Security Note
• https://wordpress.org/plugins/image-hover-effects-ultimate/#developers · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36888 · Vendor Advisory
• https://twitter.com/pdnuclei_bot/status/1995402523000311855 · Twitter Post
• https://patchstack.com/database/vulnerability/image-hover-effects-ultimate/wordpress-image-hover-effects-ultimate-plugin-9-6-1-unauthenticated-arbitrary-options-update-leading-to-full-website-compromise · Note