WordPress HTML5 Audio Player plugin <= 2.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by stealthcopter in WordPress Plugin Html5 Audio Player versions = 2.2.19...

PT-2024-30843 · WordPress · Html5 Audio Player

Name of the Vulnerable Software and Affected Versions: The HTML5 Audio Player- Best WordPress Audio Player Plugin versions up to, and including, 2.2.19 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's widgets,...

WordPress Html5 Audio Player Plugin <= 2.2.19 is vulnerable to Cross Site Scripting (XSS)

Software Html5 Audio Player Type Plugin Vulnerable versions = 2.2.19 Fixed in 2.2.22 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4398 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1188ade0c4c5 Credits stealthcopter...

HTML5 Audio Player- Best WordPress Audio Player Plugin < 2.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

Description The HTML5 Audio Player- Best WordPress Audio Player Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. Th...

JW Player for WordPress <= 2.3.3 - Missing Authorization

Description The JW Player for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to perform an unauthorized action...

CVE-2024-33931

Missing Authorization vulnerability in ilGhera JW Player for WordPress.This issue affects JW Player for WordPress: from n/a through 2.3.3...

CVE-2024-33931 WordPress JW Player for WordPress plugin <= 2.3.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in ilGhera JW Player for WordPress.This issue affects JW Player for WordPress: from n/a through 2.3.3...

CVE-2024-33931 WordPress JW Player for WordPress plugin <= 2.3.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in ilGhera JW Player for WordPress.This issue affects JW Player for WordPress: from n/a through 2.3.3...

CVE-2024-33931

CVE-2024-33931 is a Missing Authorization vulnerability affecting the JW Player for WordPress plugin. Connected Red Hat notes indicate the issue affects JW Player for WordPress versions from unknown (n/a) up to 2.3.3. The Initial description and linked Red Hat entry confirm the vulnerability type...

CVE-2023-40512

LG Simple Editor PlayerController getImageByFilename Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Although authentication is required to exploit this...

WordPress ZD YouTube FLV Player plugin <= 1.2.6 - Server-Side Request Forgery vulnerability

Server-Side Request Forgery vulnerability discovered by Mike in WordPress Plugin ZD YouTube FLV Player versions = 1.2.6...

CVE-2024-2663 ZD YouTube FLV Player <= 1.2.6 - Server-Side Request Forgery

The ZD YouTube FLV Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.6 via the $GET'image' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2024-2663 ZD YouTube FLV Player <= 1.2.6 - Server-Side Request Forgery

The ZD YouTube FLV Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.6 via the $GET'image' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

WordPress ZD YouTube FLV Player Plugin <= 1.2.6 is vulnerable to Server Side Request Forgery (SSRF)

Software ZD YouTube FLV Player Type Plugin Vulnerable versions = 1.2.6 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-2663 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID 49305c6b35a4 Credits Mike Required privile...

WordPress plugin ZD YouTube FLV Player 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

WordPress JW Player for WordPress plugin <= 2.3.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin JW Player for WordPress versions = 2.3.3...

WordPress JW Player for WordPress Plugin <= 2.3.3 is vulnerable to Broken Access Control

Software JW Player for WordPress Type Plugin Vulnerable versions = 2.3.3 Fixed in 2.3.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33931 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 9246d67d86c5 Credits Mika Required...

CVE-2024-33592

Server-Side Request Forgery SSRF vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73...

CVE-2024-33592 WordPress Radio Player plugin <= 2.0.73 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73...

CVE-2024-33592

CVE-2024-33592: SSRF in the SoftLab Radio Player WordPress plugin (Radio Player) affects versions up to 2.0.73. Public references confirm an SSRF issue; the vulnerability has been patched in a later release. No exploit details are provided in the available documents. If you use Radio Player, veri...