PT-2022-19597 · Biplob Adhikari · Image Hover Effects Ultimate

Minhtuanact + 1 · Published 2022-05-20 · Updated 2022-05-26 · CVE-2022-29424

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Biplob Adhikari's Image Hover Effects Ultimate plugin versions <= 9.7.1

Description The issue is an Authenticated Reflected Cross-Site Scripting (XSS) vulnerability. This means that an attacker can inject malicious scripts into the website, but only if they have admin or higher user role access. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For Biplob Adhikari's Image Hover Effects Ultimate plugin versions <= 9.7.1, update to a version higher than 9.7.1 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-29424

Affected Products

Image Hover Effects Ultimate

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-29424 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29424 · Vendor Advisory
• https://patchstack.com/database/vulnerability/image-hover-effects-ultimate/wordpress-image-hover-effects-ultimate-plugin-9-7-1-authenticated-reflected-cross-site-scripting-xss-vulnerability · Note
• https://wordpress.org/plugins/image-hover-effects-ultimate/#developers · Note
• https://t.me/cibsecurity/43090 · Telegram Post