The vulnerability stems from improper neutralization of user‑supplied input during page generation, allowing an attacker to inject arbitrary scripts that execute in the context of a victim’s browser. Because the attack is DOM‑based, the malicious code runs when the page is rendered on the client side, potentially enabling data theft, session hijacking, or defacement of the site. This flaw is classified as CWE‑79.

This flaw affects the WordPress plugin Image Hover Effects For WPBakery Page Builder authored by nasir179125. All released versions up to and including 2.0 are vulnerable; no supported release above 2.0 has been verified to address the issue.

The CVSS score of 6.5 places this vulnerability in the moderate severity range. The EPSS value of less than 1% indicates a very low probability of exploitation at the current time, and the flaw is not listed in CISA’s KEV catalog. While the description does not explicitly state the required conditions, the nature of a DOM‑based XSS suggests that an attacker needs a user to load a page containing the plugin; the likely attack vector is a crafted URL or payload injected into a field that the plugin processes before rendering.