CVE-2023-0170

The CVE-2023-0170 entry documents an XSS vulnerability in the WordPress Html5 Audio Player plugin prior to version 2.1.12. The issue arises because the plugin does not validate and escape certain shortcode attributes before embedding them in pages/posts, enabling users with the Contributor role o...

PT-2023-16056

Name of the Vulnerable Software and Affected Versions Html5 Audio Player WordPress plugin versions prior to 2.1.12 Description The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the lack of validation and escaping of some shortcode...

CVE-2023-0170: Undefined Security Weakness

The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress Plugin Html5 Audio Player Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Video.js - HTML5 Video Player for WordPress <= 4.5.0 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks videojs mp4='" onerror="alert/XSS/"'...

Cross site scripting

The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against hig...

CVE-2022-4542 Compact WP Audio Player < 1.9.8 - Contributor+ Stored XSS

The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against hig...

CVE-2022-4542

The CVE-2022-4542 issue affects the Compact WP Audio Player WordPress plugin prior to version 1.9.8. It arises from not validating and escaping certain shortcode attributes before output, allowing a user with as little as Contributor privileges to perform Stored XSS against higher-privilege users...

CVE-2022-4542 Compact WP Audio Player < 1.9.8 - Contributor+ Stored XSS

The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against hig...

WordPress plugin Compact WP Audio Player has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers. relevant is a relevant content display plugin used in it. wordpress plugin is an...

PT-2023-14663 · WordPress · Compact Wp Audio Player

Name of the Vulnerable Software and Affected Versions: Compact WP Audio Player WordPress plugin versions prior to 1.9.8 Description: The issue concerns the Compact WP Audio Player WordPress plugin, which does not properly validate and escape certain shortcode attributes before outputting them. Th...

CVE-2022-4542: Undefined Security Weakness

The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against hig...

MGASA-2023-0005 Updated minetest packages fix security vulnerability

This update provides minetest 5.6.1, the latest stable release of the open source voxel game. This updates provides a number of feature and bug fix changes compared to the previous version 5.4.0 provided in Mageia 8. See the linked release notes and changelogs for details. The update also improve...

Clementine Music Player Heap Buffer Overflow DoS

The vulnerability of the implementation of the MoodbarPipeline::MoodbarPipeline function in the Clementine Music Player audio player is related to an error in pointer assignment during the loading of MP3 files. Exploiting this vulnerability may allow a attacker to cause service failures or execut...

Html5 Audio Player < 2.1.12 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. h5apinlineplayer src="invalid'...

Html5 Audio Player < 2.1.12 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC h5apinlineplayer src="invalid'...

WordPress Html5 Audio Player Plugin < 2.1.12 is vulnerable to Cross Site Scripting (XSS)

Software Html5 Audio Player Type Plugin Vulnerable versions 2.1.12 Fixed in 2.1.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0170 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e11a35149ba9 Credits Lana Codes...

UBUNTU-CVE-2022-46449

An issue in MPD Music Player Daemon v0.23.10 allows attackers to cause a Denial of Service DoS via a crafted input...

Input validation

An issue in MPD Music Player Daemon v0.23.10 allows attackers to cause a Denial of Service DoS via a crafted input...

PocketMine-MP vulnerable to denial-of-service by sending large modal form responses

Impact Due to a workaround for an old client bug which has since been fixed, very large JSON payloads in ModalFormResponsePacket were able to cause the server to spend a significant amount of time processing the packet. Large numbers of these packets were able to hog CPU time so as to prevent the...