Read the docs
TI-2026-86551 Aliases CVE-2026-118056GHSA-cj55-626w-78xq

Stored cross-site scripting in Image Hover Effects Ultimate plugin

Priority LOW 20CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) plugin is affected up to and including 9.12.2. Insufficient sanitization and escaping (CWE-79) let stored scripts persist. An authenticated attacker with Subscriber access or higher can inject scripts that run when users open an injected page, if an administrator set Who can edit to Subscriber. Such users can also overwrite existing styles, including administrator-created ones.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

The Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rawdata.oxi_image_comparison_before_text' parameter in all versions up to, and including, 9.12.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an administrator has configured the plugin's "Who can edit" setting to Subscriber, which allows any authenticated user to overwrite existing styles — including those created by administrators — via a missing ownership check on the target style ID.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Biplob AdhikariImage Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )up to 9.12.2—No fix listedCNA
  • Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) VendorBiplob Adhikari Affected up to 9.12.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ).

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Timeline

  1. 2026-11-07 Threatist record created from CVE-2026-118056
  2. 2026-11-07 Alias added: GHSA-cj55-626w-78xq
  3. 2026-11-07 CISA SSVC decision points changed

References

Other 6

  • TI-2021-14977 Improper access control in Biplob Adhikari Image Hover Effects Ultimate CVSS 3.1CRITICAL 9.8
  • TI-2022-15381 WordPress Shortcode Addons plugin <= 3.0.2 - Unauthenticated Arbitrary Option Update vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-14629 WordPress Accordions plugin <= 2.0.2 - Unauthenticated WordPress Options Change vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-20503 WordPress Shortcode Addons <= 3.2.5 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.1
  • TI-2022-17812 WordPress Accordions plugin <= 2.0.3 - Auth. WordPress Options Change vulnerability CVSS 3.1HIGH 7.2
  • TI-2022-16714 WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability CVSS 3.1HIGH 7.2
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences