Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ): CSS3 animations and image gallery effects

Download Trends

Loading download data…

Vulnerabilities

9 Total

8 Patched

1 Resolved by version

0 Active

100% Resolved rate

Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 9.10.5 Patched in Resolved as of v9.11.7 (unconfirmed) Published 19 Nov 2025 CVE CVE-2025-5092

Image Hover Effects Ultimate 9.8.1 - 9.8.4 - Authenticated (Admin+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.

5.5 Medium Affected 9.8.1 – 9.8.4 Patched in ✓ 9.8.5 Published 11 Dec 2022 CVE CVE-2022-4207

Image Hover Effects Ultimate <= 9.7.1 - Authenticated (Admin+) Arbitrary Options Update

CWE-639 · Authorization Bypass Through User-Controlled Key

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Arbitrary Options Update in versions up to, and including, 9.7.1. This is due to a lack of validation on the settings supplied to the post_oxi_settings() function. This makes it possible for authenticated attackers, with administrative level permissions, to update arbitrary options on the WordPress site. This would only affect sites where the administrator has been restricted to not 'manage_options' or the administrator has allowed users with lower permissions to update the plugin's settings.

7.2 High Affected All – 9.7.1 Patched in ✓ 9.7.2 Published 25 Oct 2022 CVE CVE-2022-42459

Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Video Link

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Video Link values that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.

6.4 Medium Affected All – 9.7.3 Patched in ✓ 9.8.0 Published 31 Aug 2022 CVE CVE-2022-2936

Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Media URL

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media Image URL value that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.

6.4 Medium Affected All – 9.7.3 Patched in ✓ 9.8.0 Published 31 Aug 2022 CVE CVE-2022-2935

Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Title & Description

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Description values that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.

6.4 Medium Affected All – 9.7.3 Patched in ✓ 9.8.0 Published 31 Aug 2022 CVE CVE-2022-2937

Image Hover Effects Ultimate <= 9.7.1 - Reflected Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Authenticated (admin or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin <= 9.7.1 at WordPress. Please note that this is separate from CVE-2021-25031.

6.1 Medium Affected All – 9.7.1 Patched in ✓ 9.7.2 Published 4 May 2022 CVE CVE-2022-29424

Image Hover Effects Ultimate <= 9.7.0 - Reflected Cross-Site Scripting via effects

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

6.1 Medium Affected All – 9.7.0 Patched in ✓ 9.7.1 Published 27 Dec 2021 CVE CVE-2021-25031

Image Hover Effects Ultimate <= 9.6.1 - Unauthenticated Arbitrary Options Update

CWE-284 · Improper Access Control

Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.

9.8 Critical Affected All – 9.6.1 Patched in ✓ 9.6.2 Published 15 Dec 2021 CVE CVE-2021-36888

Support Statistics

1 Support threads

1 Resolved

100% Resolution rate

About Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )

Add stunning image hover effects to WordPress. 500+ CSS3 animations, 10 effect modules. Native Elementor widget, Gutenberg block & WPBakery widget.

Image Hover Effects Ultimate is the most powerful image hover effects plugin for WordPress. Whether you want a clean caption reveal, a dramatic flip card, a side-by-side image comparison, or a magnifier zoom, you’ll find exactly what you need from 500+ CSS3 animations and 1500+ ready-to-use layouts.

✨ No coding. No jQuery. Just beautiful hover effects that work everywhere.

Trusted by 20,000+ WordPress users, the plugin is lightweight, fully responsive, and compatible with Elementor, Gutenberg, WPBakery, Divi, Beaver Builder, and SiteOrigin.

🎬 Live Demos | ⭐ Upgrade to Pro | 📖 Documentation | 🆘 Support

Hover effects are one of the easiest ways to make your WordPress site feel polished and professional. With Image Hover Effects Ultimate, you choose a style from the template library, upload your images, paste a shortcode, and you’re done.

Every image hover animation is built in pure CSS3, so effects are silky smooth without adding any JavaScript weight to your pages.

🚀 Key Features

🎨 500+ CSS3 hover animations: fades, slides, flips, zooms, overlays, caption reveals, and more
🖼️ 1500+ pre-designed layouts: professionally crafted templates ready to customize
📦 10 powerful effect modules: General, Caption, Flipbox, Button, Square, Lightbox, Comparison, Magnifier, Carousel, and Filter
👁️ Live preview: see every change in real time without leaving the editor
📱 Fully responsive: independent layout controls for desktop, tablet, and mobile
👆 Touch-friendly: smooth interactions on iOS and Android devices
🔤 650+ Google Fonts: full typography control for headings, descriptions, and buttons
⚡ Pure CSS3, no jQuery: fast-loading animations that don’t slow your site down
🔁 Clone any style: duplicate an effect and customize it without starting from scratch
🛠️ Custom CSS editor: add your own CSS for total creative control
♻️ Built-in cache system: optimized loading even on pages with many images
🔌 Native Elementor widget: select and embed effects directly from the Elementor editor panel, no shortcode needed
🟦 Native Gutenberg block: insert and live-preview effects directly from the WordPress block editor, no shortcode needed
🧩 Works with every major page builder: WPBakery, Divi, Beaver Builder, and SiteOrigin support via shortcode

✨ Free Version Features

The free version is genuinely capable. Here is everything included at no cost:

✅ All 10 effect modules available
✅ 500+ CSS3 image hover animations
✅ 1500+ pre-designed layout templates
✅ Live preview admin panel
✅ Fully responsive with per-device controls (🖥️ Desktop, 📱 Tablet, 📲 Mobile)
✅ Touch and mobile device support
✅ One-click style cloning
✅ Image alignment, padding, and margin controls
✅ Per-item links with optional new-tab support
✅ Built-in cache system
✅ Custom CSS editor
✅ Shortcode-based, works in any post, page, or widget
✅ Native Gutenberg block: insert and preview effects directly from the block editor, no shortcode needed
✅ Native Elementor widget: select and embed effects directly from the Elementor editor panel, no shortcode needed
✅ WPBakery, Divi, Beaver Builder, and SiteOrigin support via shortcode
✅ SEO-friendly HTML output with proper alt tag support

🔥 Pro Version Features

Pro unlocks the full creative toolkit and priority support:

🔓 Full customization of all 500+ hover effects: control colors, overlays, borders, shadows, and timing on every style
🎨 Advanced color pickers: unlimited color control for text, backgrounds, overlays, borders, buttons, and hover states
🔤 650+ Google Fonts: independent font selection for headings, descriptions, and button text
✏️ Custom font sizes: separate size controls for every text element
🖼️ Border and shadow settings: fine-tune border width, radius, and box shadows per element
♾️ Unlimited hover items per shortcode
🔗 Advanced link options: open links in a new tab on a per-item basis
💻 Custom CSS generation: override styles at the individual effect level
📹 Video tutorials for every feature
🎧 24/7 priority support with responses within 12 hours

👉 See All Free vs Pro Features

🎯 Perfect For

🎨 Portfolios and agencies, showcase work with stylish image reveals and hover captions
🛍️ eCommerce and WooCommerce, highlight product details, overlays, and buy buttons on hover
📸 Photographers, display galleries with elegant hover overlays and lightbox popups
👥 Team pages, show staff names, roles, and social links with caption hover effects
📰 Blogs and magazines, make featured images more engaging with CSS hover animations
🏠 Landing pages, draw attention to key visuals and CTAs with smooth motion
🔬 Product detail pages, use the magnifier module to zoom into product images on hover

📈 Why Use This Plugin

There are a few image hover plugins out there, but Image Hover Effects Ultimate is the one that covers every use case in one place.

Here is why 20,000+ users choose it:

📦 All modules in one plugin: General Effects, Caption Effects, Flipbox, Lightbox, Comparison, Magnifier, Carousel, and Filter are all built in. No separate add-ons needed.
🖱️ No coding required: everything is configured through the visual admin panel with live preview
⚡ Lightweight: pure CSS3 output with zero jQuery dependency keeps your pages fast
🧩 Builder ready: native Elementor widget and Gutenberg block included; shortcodes also work in Divi, WPBakery, Beaver Builder, and any other builder
🔒 Actively maintained: regular updates, PHP 8.4 compatibility, and security hardening with every release
👨‍💻 Developer-friendly: custom CSS support, PSR-4 namespacing, and a clean codebase make it easy to extend

Screenshots

🗂️ Image Hover dashboard showing all effect modules.

🖼️ Template library: browse and select from 150+ pre-designed layouts.

✏️ Naming a new shortcode before customization begins.

🎛️ Fully customizable admin panel with live preview.

➕ Image upload and content form for individual hover items.

🎨 Background settings with gradient and image upload options.

🔤 Typography controls with Google Fonts for headings and descriptions.

📱 Responsive device preview controls: Desktop, Tablet, and Mobile.

🎠 Carousel and Slider extension with hover effects.

🔽 Shortcode List.

Frequently Asked Questions

🔌 Does this plugin work with Elementor?

Yes. The plugin includes a native Elementor widget. Search for “Image Hover” in the Elementor editor panel, drag it onto your page, and select your effect directly from the widget’s Inspector Controls, no shortcode needed. You can also use the shortcode approach if you prefer.

🟦 Does it work with the Gutenberg block editor?

Yes. The plugin includes a native Gutenberg block. Search for “Image Hover” in the block inserter, add the block, and select your effect from the Inspector Controls sidebar. A live preview renders directly in the editor, no shortcode needed.

💻 Do I need to write any code?

No. All effects are created through the visual admin panel. Developers who want more control can also add custom CSS, but it is completely optional.

📱 Are the effects mobile-friendly?

Yes. Every layout is fully responsive with separate controls for desktop, tablet, and mobile. Touch interactions also work smoothly on iOS and Android.

🆓 What is the difference between free and Pro?

The free version gives you access to all 10 modules and hundreds of layouts. Pro unlocks full customization of every effect: advanced color controls, 650+ Google Fonts, border and shadow settings, unlimited items, and priority support. See the 🔥 Pro section above for the full list.

Ratings & Reviews

Recent Reviews

Loading reviews…

View all reviews on WordPress.org (opens in a new tab)

Changelog

9.11.7

🐛 Fix: Edit and rearrange modals now populate correctly for image items saved on older versions, legacy rawdata stored with extra backslash escaping is decoded with a stripslashes fallback that matches the render paths
🐛 Fix: Removed Undefined array key PHP warnings on the frontend when rendering General effects created on older versions where heading, description or button fields were not stored, missing item fields are now checked safely

9.11.6

🆕 New: Added native Gutenberg block, insert and preview Image Hover Effect styles directly from the WordPress block editor without writing shortcodes
🆕 New: Style selector and Edit Style button placed in the block’s Inspector Controls sidebar, keeping the editor canvas clean with only the live preview
🆕 New: Plugin’s branded SVG icon displayed in the Gutenberg block inserter
✨ Improvement: All CSS (base styles, module-specific styles, and per-shortcode stylesheet) is fully inlined during block editor REST rendering so the hover effect preview displays correctly without relying on wp_footer

9.11.5

🔒 Security: Fixed path traversal vulnerability in template import, file reads are now restricted within the plugin directory using realpath() validation
🔒 Security: Fixed missing authorization check in AJAX action handler, requests now require proper user permissions
🔒 Security: Sanitized CSS output in frontend style block to prevent potential </style> injection
🔒 Security: Strip </style> tags from custom CSS before storing to database
🐛 Fix: Renamed “Save” button to “Rename” in the editor header to avoid confusion with the main Save button
✨ Improvement: Added “How to use?” documentation link in the editor header for quick access to getting started guide

9.11.4

🐛 Fix: Fixed Flipbox back side image not displaying across all styles, corrected invalid CSS syntax where !important was placed inside url() (Style 1) and replaced background shorthand with background-image to prevent unintended property resets
🐛 Fix: Fixed Flipbox back side overlay color not working, background image is now applied to the correct layer (backend:after) so the admin-configured background color properly acts as a semi-transparent overlay on top of the image
✨ Improvement: Replaced background-size: 100% 100% with background-size: cover and added background-position: center center and background-repeat: no-repeat for better image rendering across all Flipbox styles

9.11.3

✨ Improvement: Added dynamic “Edit Shortcode” button to Elementor Widget for quick access to the styling dashboard
🐛 Fix: Resolved issue where the shortcode edit button URL wouldn’t update on dropdown change
🐛 Fix: Fixed CSS and JS failing to load on the plugin’s internal backend template listing and editor pages
🐛 Fix: Corrected asset isolation logic in the iframe preview which accidentally blocked some internal scripts
🐛 Fix: Whitelisted missing external dependencies (e.g., image zoom, isotope) in the iframe preview to prevent layout breaks
🐛 Fix: Resolved CSS handle collisions between the Lightbox and Magnifier modules which caused Lightbox styles to fail loading
🐛 Fix: Fixed raw CSS text leaking onto the screen in nested modules (e.g., Filter) by properly sanitizing content before shortcode evaluation

9.11.2

🆕 New: Added Elementor Widget for Image Hover Effects, select and embed shortcodes directly from the Elementor editor
🐛 Fix: Resolved CSS and JS not loading in the Elementor editor for module-specific styles (Flipbox, General, Carousel, etc.)
🐛 Fix: Fixed inline CSS and JS not rendering during Elementor AJAX widget re-renders
🐛 Fix: Fixed styles missing after saving and reloading the Elementor editor
✨ Improvement: Registered base CSS/JS assets for proper Elementor dependency resolution

9.11.1

🐛 Fix: Resolved PHP 8.4 compatibility issue with mb_ereg_replace function
✨ Improvement: Replaced dashicon with a custom SVG icon in the admin sidebar for a cleaner branded appearance
✨ Improvement: Updated admin panel logo from PNG to SVG format in the header and Getting Started page
✨ Improvement: Hardcoded total template count to 150+ in the dashboard for accurate display
🔄 Update: Replaced all demo image URLs with new CDN format using WebP for faster loading

9.11.0

🆕 New: Added item count display for each module in the Image Hover dashboard
🆕 New: Added Create New and Import buttons to the Shortcode page header
🆕 New: Implemented iframe-based preview for strict style isolation and better performance
🆕 New: Added responsive device controls (Desktop, Tablet, Mobile) with live preview scaling
✨ Improvement: Moved inline CSS to external admin stylesheet for better maintainability
✨ Improvement: Simplified template selection, all templates now visible directly on the effect page
🐛 Fix: Fixed CSS specificity issues where saved styles could override live preview changes
🐛 Fix: Resolved backward compatibility issues with legacy shortcode data
🐛 Fix: Resolved Pro feature access issues with legacy license status

9.10.6

🆕 New: Conditional asset loading, Waypoints and Touch scripts only load when enabled in settings
🆕 New: Added cache-busting for admin assets via file modification time
✨ Improvement: Hardened AJAX and REST flows with stricter nonce verification
🐛 Fix: Minor stability fixes across shortcode rendering and widget output escaping
🔒 Fix: Fixed security issue in the Lightbox module

9.10.5

🐛 Fix: Resolved WordPress 6.7 “_load_textdomain_just_in_time” notice
🐛 Fix: Allowed safe HTML in Short Description fields using wp_kses_post
✨ Improvement: Deferred heavy operations to later hooks for better performance

9.10.4

🆕 New: Added Getting Started page for new users
🎨 Update: Refreshed UI and UX across the admin panel
🐛 Fix: Fixed HTML tags not rendering in Lightbox title and description fields
🐛 Fix: Fixed HTML tags not rendering in button text across all modules
🐛 Fix: Fixed Visual Composer integration, dropdown now correctly passes Style ID
🐛 Fix: Fixed PHP 8.2 deprecation warning for dynamic properties
✨ Improvement: Enhanced error handling and input validation throughout the shortcode system

9.10.3

🔒 Fix: Resolved all reported security vulnerabilities
✨ Improvement: Improved input sanitization and output escaping throughout the plugin
✨ Improvement: Updated all database queries to use $wpdb->prepare()