CVE-2021-36888: Blocksera Image Hover Effects

Critical severity, CVSS 9.8. EPSS: 6.5% chance of exploitation in the next 30 days.

Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.

Affected products

• Blocksera Image Hover Effects: before 9.6.1 (fixed in 9.6.1)

Published 2021-12-15. Last modified 2026-06-17.