This vulnerability involves improper neutralization of input in the Image Hover Effects For WPBakery Page Builder plugin by nasir179125, leading to a DOM-based cross-site scripting (XSS) issue. The flaw exists in versions up to 2.0 and allows an attacker to inject malicious scripts during web page generation. The CVSS 3.1 score is 6.5 (medium), with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality, integrity, and availability. No known exploits are reported in the wild. The plugin is not a cloud service, and no patch or vendor advisory is currently provided.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially compromising user data confidentiality, integrity, and availability. The attack requires user interaction and some privileges, limiting but not eliminating risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting privileges of users who can interact with the affected plugin and monitor for suspicious activity related to DOM-based XSS. Avoid exposing the vulnerable plugin to untrusted users if possible.