This vulnerability is a DOM‑based XSS flaw caused by insufficient sanitization of input in the Ultimate Image Hover Effects plugin. The flaw allows the attacker to inject arbitrary JavaScript that will execute in the browser of any user who loads the affected page, potentially compromising the authenticity and integrity of the site.

The issue exists in the WordPress plugin themebon Ultimate Image Hover Effects any installation using version 1.1.2 or earlier. The plugin is widely used across WordPress sites; no specific WordPress version or operating system constraints are mentioned.

With a CVSS score of 6.5 the vulnerability is moderate severity. The EPSS value of less than 1% indicates a very low probability of exploitation and the flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector would involve a crafted input that the plugin echoes back into the page, triggering the DOM‑based XSS. This attack is only effective when a user’s browser loads the affected page, so the surface is limited to visitors of the site.