Image Hover Effects Addon For Elementor Vulnerabilities

The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

5.4

Affected:

up to 1.4.4

Fix:

No patched version reported

Disclosed:

Sep 22, 2025

CVE-2025-57939 on NVD →

[en] The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eihe_link’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-leve...

Affected:

up to 1.4.4

Fixed in:

1.4.4

Disclosed:

Jul 16, 2024

CVE-2024-4780 on NVD →

The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eihe_link’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acc...

CVSS:

6.4

Affected:

up to 1.4.3

Fixed in:

1.4.4

Disclosed:

Jul 15, 2024

CVE-2024-4780 on NVD →

[en] The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hover Effects Widget in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for auth...

Affected:

up to 1.4.2

Fixed in:

1.4.2

Disclosed:

May 9, 2024

CVE-2024-1166 on NVD →

The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hover Effects Widget in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentic...

CVSS:

6.4

Affected:

up to 1.4.1

Fixed in:

1.4.2

Disclosed:

May 6, 2024

CVE-2024-1166 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blocksera Image Hover Effects – Elementor Addon allows Stored XSS.This issue affects Image Hover Effects – Elementor Addon: from n/a through 1.4.

Affected:

up to 1.4.1

Fixed in:

1.4.1

Disclosed:

Mar 27, 2024

CVE-2024-29936 on NVD →

The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eihe_align' parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a...

CVSS:

6.4

Affected:

up to 1.4

Fixed in:

1.4.1

Disclosed:

Mar 25, 2024

CVE-2024-29936 on NVD →

[en] The “Image Hover Effects – Elementor Addon” WordPress Plugin before 1.3.4 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

Affected:

up to 1.3.4

Fixed in:

1.3.4

Disclosed:

May 5, 2021

CVE-2021-24264 on NVD →

The “Image Hover Effects – Elementor Addon” WordPress Plugin before 1.3.4 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

CVSS:

6.4

Affected:

up to 1.3.4

Fixed in:

1.3.4

Disclosed:

Apr 13, 2021

CVE-2021-24264 on NVD →

Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered by WordFence in WordPress Image Hover Effects – Elementor Addon plugin (versions <= 1.3.3).

Affected:

up to 1.3.4

Fixed in:

1.3.4

Disclosed:

Apr 13, 2021

Affected:

up to 1.4.4

Fix:

No patched version reported

CVE-2025-57939 on NVD →