CVE-2022-4207 (PHP, published 2022-12-13T21:15Z)
Description: value: The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MrOxizen/image-hover-effects-ultimate
Files changed:
Modules/Lightbox/Render/Effects1.php
Modules/Lightbox/Render/Effects2.php
Page/Public_Render.php
Commit message: Update


Vulnerable code:
                                    </div> 
            ?>"> 
                <div class="oxi_addons__light_box_parent"> 
                    <div class="oxi_addons__light_box_item  lightbox_key_<?php echo (int) $key; ?>" <?php
                        ?>>  
                             <?php
                                            <?php $this->text_render($value['oxi_image_light_box_button_text']) ?> 
                    ?>  
            </div> 
                                     this.items[0].src = this.items[0].src + "?=" + Math.random(); 
                        },  
                 .oxi-image-hover-wrapper-' . $this->oxiid . ' .Oxipopup-image-holder .Oxipopup-close, 
                 
class Public_Render
{
    public function __construct(array $dbdata = [], array $child = [], $admin = 'user')
    {
    public function loader()
    {
    public function old_loader()
    {
    public function public_frontend_loader()
    {
    public function hooks()
    {



    public function render()
    {
?>
     public function oxi_addons_admin_edit_delete_clone($param)
    {
<?php
    public function old_render()
    {
    public function public_jquery()
    {
    public function public_css()
    {
    public function inline_public_jquery()
    {
    public function inline_public_css()
    {
    public function default_render($style, $child, $admin)
    {
    public function Json_Decode($rawdata)
    {
    public function name_converter($data)
    {
        return ucwords($data);
    public function font_familly_validation($data = [])
    {
    public function font_familly($data = '')
    {
        return '"' . $data[0] . '"';
    public function admin_name_validation($data)
    {
        return ucwords($data);
    public function array_render($id, $style)
    {
    public function check_media_render($id, $style)
    {
    public function media_render($id, $style)
    {
    public function media_background_render($id, $style)
    {
        return $url;
    public function allowed_html_sanitize($rawdata)
    {
    public function text_render($data)
    {
        echo do_shortcode(str_replace('spTac', '&nbsp;', str_replace('spBac', '<br>', html_entity_decode($data))), $ignore_html = false);
    public function return_text($data)
    {
        return do_shortcode(str_replace('spTac', '&nbsp;', str_replace('spBac', '<br>', html_entity_decode($data))), $ignore_html = false);
    public function font_awesome_render($data)
    {
    public function tab_column_render($id, $style)
    {
    public function mob_column_render($id, $style)
    {
    public function column_render($id, $style)
    {
    public function checkurl_render($id, $style)
    {
    public function url_render($id, $style)
    {
    public function animation_render($id, $style)
    {
    public function background_render($id, $style, $class)
    {
    public function CatStringToClassReplacce($string, $number = '000')
    {
    public function old_column_render($d, $type)
    {
  public function old_button_alignment_render($d)
    {
    public function old_alignment_render($d)
    {
  

   

Fixed code:
                                    </div>
            ?>">
                <div class="oxi_addons__light_box_parent">
                        <div class="oxi_addons__light_box_item  lightbox_key_<?php echo (int) $key; ?>" <?php
                        ?>>
                                 <?php
                                            <?php $this->text_render($value['oxi_image_light_box_button_text']) ?>
                    ?>
            </div>
                                     this.items[0].src = this.items[0].src + "?=" + Math.random();
                        },
                 .oxi-image-hover-wrapper-' . $this->oxiid . ' .Oxipopup-image-holder .Oxipopup-close,

class Public_Render {
    public function __construct(array $dbdata = [], array $child = [], $admin = 'user') {
    public function loader() {
    public function old_loader() {
    public function public_frontend_loader() {
    public function hooks() {
    public function render() {
            ?>

    public function oxi_addons_admin_edit_delete_clone($param) {
        <?php
    public function old_render() {
    public function public_jquery() {
    public function public_css() {
    public function inline_public_jquery() {
    public function inline_public_css() {
    public function default_render($style, $child, $admin) {
    public function Json_Decode($rawdata) {
    public function name_converter($data) {
        return esc_attr(ucwords($data));
    public function font_familly_validation($data = []) {
    public function font_familly($data = '') {
        return '"' . esc_attr($data[0]) . '"';
    public function admin_name_validation($data) {
        return esc_attr(ucwords($data));
    public function array_render($id, $style) {
    public function check_media_render($id, $style) {
    public function media_render($id, $style) {
    public function media_background_render($id, $style) {
        return esc_url($url);
    public function allowed_html_sanitize($rawdata) {
    public function text_render($data) {
        echo wp_kses_post(do_shortcode(str_replace('spTac', '&nbsp;', str_replace('spBac', '<br>', html_entity_decode($data))), $ignore_html = false));
    public function return_text($data) {
        return wp_kses_post(do_shortcode(str_replace('spTac', '&nbsp;', str_replace('spBac', '<br>', html_entity_decode($data))), $ignore_html = false));
    public function font_awesome_render($data) {
    public function tab_column_render($id, $style) {
    public function mob_column_render($id, $style) {
    public function column_render($id, $style) {
    public function checkurl_render($id, $style) {
    public function url_render($id, $style) {
    public function animation_render($id, $style) {
    public function background_render($id, $style, $class) {
    public function CatStringToClassReplacce($string, $number = '000') {
    public function old_column_render($d, $type) {

    public function old_button_alignment_render($d) {

    public function old_alignment_render($d) {