The vulnerability is a stored cross‑site scripting flaw in the Image Hover Effects Ultimate WordPress plugin, enabled via the rawdata.oxi_image_comparison_before_text parameter. Authenticated users with subscriber or higher privileges can inject arbitrary scripts because input is not sanitized or escaped. Those scripts run whenever a page containing the injected content is viewed, allowing malicious code execution in the context of the site and potentially affecting other authenticated users.

The affected product is the Image Hover Effects Ultimate plugin by oxilab, for WordPress sites. All releases up to and including version 9.12.2 are affected whenever the plugin’s Who can edit option permits subscriber‑level users to edit styles.

The CVSS score is 4.9, indicating moderate risk. The EPSS score is unavailable, and the vulnerability is not in CISA KEV. Because it requires authenticated subscribers and depends on the plugin configuration, the attack surface is limited to sites where the editor role has been set to allow subscriber edits. If exploited, attackers can insert scripts that execute in the browser of any visitor to the affected page, which may lead to defacement, data theft, or credential theft. The lack of a known public exploit means the likelihood is low, but the impact to affected users warrants timely remediation.