Lucene search

K
patchstackJoão Pedro Soares de Alcântara (Kinorth)PATCHSTACK:0421A3D792D23BC18999EAD9A0E64F81
HistoryOct 21, 2024 - 12:00 a.m.

WordPress Agile Video Player Lite Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

2024-10-2100:00:00
João Pedro Soares de Alcântara (Kinorth)
patchstack.com
1
wordpress
agile video player lite
cross site scripting
vulnerable version
cve-2024-49636
medium severity
unauthenticated

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

18.0%

Software

Agile Video Player Lite

Type

Plugin

Vulnerable versions

<= 1.0

Fixed in

N/A

OWASP Top 10

A3: Injection

Classification

Cross Site Scripting (XSS)

CVE

CVE-2024-49636

Patch priority

Medium

CVSS severity

Medium (7.1)

Developer

Claim ownership

PSID

267bc8c567b6

Credits

João Pedro Soares de Alcântara Kinorth João Pedro Soares de Alcântara (Kinorth)

Required privilege

Unauthenticated

Published

21 October, 2024

Remove and replace plugin Expand full details Have additional information or questions about this entry? Let us know.

Solution

We advise to mitigate or resolve the vulnerability immediately.

Affected configurations

Vulners
Node
-agile_video_player_liteRange1.0
VendorProductVersionCPE
-agile_video_player_lite*cpe:2.3:a:-:agile_video_player_lite:*:*:*:*:*:*:*:*

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

18.0%

Related for PATCHSTACK:0421A3D792D23BC18999EAD9A0E64F81