CVE-2023-6485 - Html5 Video Player < 2.5.19 - Subscriber+ Stored XSS

Back Back to CVE browser

MEDIUM

Html5 Video Player < 2.5.19 - Subscriber+ Stored XSS

Published Jan 1, 2024

5.4

MEDIUM

CVSS 3.1

EPSS 0.53%

Description

The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins

Affected products

Vendor n/a Product Html5 Video Player Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.5.19

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Html5 Video Player

unaffected

Version	Status	Constraints
0	affected	<2.5.19

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-58716
Advisory
https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-58716		Advisory
https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81		exploitvdb-entrytechnical-descriptionThird Party Advisory