CVE-2022-4207

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.

• https://github.com/MrOxizen/image-hover-effects-ultimate/commit/4ba784e1a2a0cf02e8b8cbe3db7323735d7dedc9Patch, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2830197%40image-hover-effects-ultimate&new=2830197%40image-hover-effects-ultimate&sfp_email=&sfph_mail=Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f00cdef3-d733-4e85-8099-204ef76096b4Third Party Advisory
• https://github.com/MrOxizen/image-hover-effects-ultimate/commit/4ba784e1a2a0cf02e8b8cbe3db7323735d7dedc9Patch, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2830197%40image-hover-effects-ultimate&new=2830197%40image-hover-effects-ultimate&sfp_email=&sfph_mail=Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f00cdef3-d733-4e85-8099-204ef76096b4Third Party Advisory

Published

Dec 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-4206A sensitive information leak issue has been discovered in al…6.5
• CVE-2022-42060Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was disco…7.5
• CVE-2022-42064Online Diagnostic Lab Management System version 1.0 remote e…9.8
• CVE-2022-42066Online Examination System version 1.0 suffers from a cross s…6.1
• CVE-2022-42067Online Birth Certificate Management System version 1.0 suffe…4.3
• CVE-2022-42069Online Birth Certificate Management System version 1.0 suffe…5.4
• CVE-2022-42070Online Birth Certificate Management System version 1.0 is vu…8.8
• CVE-2022-42071Online Birth Certificate Management System version 1.0 suffe…6.1
• CVE-2022-42073Online Diagnostic Lab Management System v1.0 is vulnerable t…7.2
• CVE-2022-42074Online Diagnostic Lab Management System v1.0 is vulnerable t…7.2
• CVE-2022-42075Wedding Planner v1.0 is vulnerable to arbitrary code executi…9.8
• CVE-2022-42077Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 is vul…6.5