CVE-2025-53258

The Hover Effects plugin for WordPress, developed by Wow-Company, contains a SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. Versions through 2.1.2 are affected, allowing attackers to inject malicious SQL queries via unsanitized user input [1].

Exploitation does not require authentication; an attacker can send crafted HTTP requests to the vulnerable plugin endpoint. This type of vulnerability is frequently leveraged in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity [1].

Successful exploitation enables an attacker to directly interact with the underlying database. This can lead to unauthorized reading, modification, or deletion of data, including sensitive information such as user credentials and site configuration [1].

The vendor has addressed the issue in version 2.1.3. Users are strongly advised to update to this version or later. Patchstack users can enable auto-updates for vulnerable plugins to ensure timely patching [1].