CVE-2022-4207: oxilab image hover effects ultimate

csirt@kutim:~/threat-intel/cve/CVE-2022-4207

CVSS 5.4 · Medium EPSS 0,57%

Kerentanan pada oxilab image hover effects ultimate. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.

Rincian

Terbit di NVD: 13 Desember 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
EPSS (30 hari): 0,57% peluang dieksploitasi; lebih tinggi dari 45,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
oxilab	image hover effects ultimate	Versi 9.8.1 hingga 9.8.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/MrOxizen/image-hover-effects-ultimate/commit/4ba784e1a2a0cf02e8b8cbe3db7323735d7dedc9 patch · advisory pihak ketiga
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2830197%40image-hover-effects... advisory pihak ketiga
https://www.wordfence.com/threat-intel/vulnerabilities/id/f00cdef3-d733-4e85-8099-204ef76096b4 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.