Read the docs
TI-2021-14977 Aliases CVE-2021-36888GHSA-8fjw-gv37-439q

Improper access control in Biplob Adhikari Image Hover Effects Ultimate

Priority MEDIUM 58CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.06532 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Biplob AdhikariImage Hover Effects Ultimate (WordPress plugin)<= 9.6.1 – 9.6.1—No fix listedCNA
  • Image Hover Effects Ultimate (WordPress plugin) VendorBiplob Adhikari Affected <= 9.6.1 – 9.6.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:blocksera:image_hover_effects:*:*:*:*:*:wordpress:*:*before 9.6.1VulnerableBlocksera
  • cpe:2.3:a:blocksera:image_hover_effects:*:*:*:*:*:wordpress:*:* Versions before 9.6.1 Vulnerable ·Blocksera

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-36888
  2. 2026-10-03 Alias added: GHSA-8fjw-gv37-439q

References

Advisory 2

  • TI-2022-15381 WordPress Shortcode Addons plugin <= 3.0.2 - Unauthenticated Arbitrary Option Update vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-14629 WordPress Accordions plugin <= 2.0.2 - Unauthenticated WordPress Options Change vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-20503 WordPress Shortcode Addons <= 3.2.5 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.1
  • TI-2022-17812 WordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability CVSS 3.1HIGH 7.2
  • TI-2022-16714 WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability CVSS 3.1HIGH 7.2
  • TI-2022-14965 WordPress Shortcode Addons plugin <= 3.1.2 - Authenticated WordPress Options Change vulnerability CVSS 3.1HIGH 7.2
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences