This vulnerability in the Hover Image Button plugin by Ignacio Perez allows DOM-based XSS due to improper input neutralization during web page generation. It affects all versions up to 1.1.2. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided, and the product is not a cloud service.

Successful exploitation could allow an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the victim's browser context, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected application or user data. The impact is rated medium based on the CVSS score and vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting privileges and limiting exposure to untrusted input in the Hover Image Button plugin. Monitor vendor channels for updates and apply official fixes once released.