CVE-2021-36888: blocksera image_hover_effects
CVSS: 9.8v3.1CriticalModified
Published 15-12-2021Last modified 28-04-2026
Vulnerability summary
CVE-2021-36888 is a critical (CVSS 9.8) vulnerability in blocksera image_hover_effects. EPSS estimates a 6.53% chance of exploitation in the next 30 days, higher than 93.7% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
6.53%
0%100%
Low · -0.15 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 15-12-2021PublishedVulnerability first disclosed.
- 28-04-2026Last modifiedVulnerability information updated.
Description
Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.
CVSS metrics
4 scores · 3 sources · 2 versionsCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
6.53%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
-0.15 pp
From 6.69% on 21-09-2026
21-09-202621-10-2026
EPSS score6.53%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affected systems
Blocksera1 product
- image_hover_effects< 9.6.1
Oxilab1 product
- image hover effects ultimate (wordpress plugin)≥ <= 9.6.1, ≤ 9.6.1
Wordpress1 product
- image-hover-effects-ultimate≤ 9.6.1 (fixed in 9.6.2)
3 vendors · 3 products