Hover Effects <= 2.1.2 - Authenticated (Administrator+) SQL Injection
medium
The Hover Effects plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and...
- CVSS:
- 4.9
- Affected:
- up to 2.1.2
- Fixed in:
- 2.1.3
- Disclosed:
- Jun 27, 2025
CVE-2025-53258 on NVD →
Hover Effects – easily create any hover effect <= 2.1 - Authenticated Local File Inclusion
medium
Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.
- CVSS:
- 6.8
- Affected:
- up to 2.1
- Fixed in:
- 2.1.1
- Disclosed:
- May 16, 2022
CVE-2022-29447 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database