WordPress Vimeo Video Autoplay Automute Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Vimeo Video Autoplay Automute Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0153 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6b9ac437c259 Credits István...

WordPress GamiPress – Vimeo integration Plugin < 1.0.9 is vulnerable to Cross Site Scripting (XSS)

Software GamiPress – Vimeo integration Type Plugin Vulnerable versions 1.0.9 Fixed in 1.0.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0154 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID eece071753de Credits Lana...

Vimeo Video Autoplay Automute <= 1.0 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. vimeo clipid="1" color="'...

GamiPress – Vimeo integration < 1.0.9 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. gamipressvimeo url='https://vimeo.com/"...

GamiPress – Vimeo integration < 1.0.9 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC gamipressvimeo url='https://vimeo.com/"...

Vimeo Video Autoplay Automute <= 1.0 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC vimeo clipid="1" color="'...

PT-2022-26992 · D Link · D-Link Dir-825

Name of the Vulnerable Software and Affected Versions: D-Link DIR-825 versions 1.0.9/EE Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the Vimeo...

D-Link DIR-825/EE xupnpd Vimeo Plugin Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Vimeo plugin for the xupnpd service, which listens on TCP port...

MAL-2022-704 Malicious code in @vimeo-date-time/relative (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51c1473d4b322bc5f9c72860e45ae3b00ddf07bbc787e6c699729ff45208ab5c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-888 Malicious code in aframe-vimeo-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72339f974aab0b3963dfa3046690d61a625af2fe12b6b1154f027f80e3901a75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aframe-vimeo-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72339f974aab0b3963dfa3046690d61a625af2fe12b6b1154f027f80e3901a75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vimeo_depth_player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a54fcc7eb6c3b7b858ef789b0478e6e97cc8fe1b20f3a774a4d55742c21bf774 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vimeo-threejs-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73ac756c3faaf5d660ad076c8f367c2e70b3c5e8f26198970162b7df50e67866 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6933 Malicious code in vimeo-threejs-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73ac756c3faaf5d660ad076c8f367c2e70b3c5e8f26198970162b7df50e67866 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin <= 2.3.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Gallery Blocks with Lightbox. Image Gallery, HTML5 video , YouTube, Vimeo Video Gallery and Lightbox for native gallery plugin versions = 2.3.5. Solution Update the WordPress Gallery Blocks with Lightbox. Image Gallery, HTML5...

WordPress "WordPress YouTube, Vimeo and more elements security Plugin (GDPR)" plugin <= 1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress "WordPress YouTube, Vimeo and more elements security Plugin GDPR" plugin versions = 1.2. Solution No patched version available...

WordPress VidSEO | WordPress Video SEO embedder with transcripts (Youtube & Vimeo) plugin <= 1.2.3.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress VidSEO | WordPress Video SEO embedder with transcripts Youtube & Vimeo plugin versions = 1.2.3.2. Solution Update the WordPress VidSEO | WordPress Video SEO embedder with transcripts Youtube & Vimeo...

WordPress "WordPress YouTube, Vimeo and more elements security Plugin (GDPR)" plugin <= 1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "WordPress YouTube, Vimeo and more elements security Plugin GDPR" plugin versions = 1.2. Solution No patched version available...

GHSA-HG2P-2CVQ-4PPV Cross-site scripting in lazysizes

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Video Gallery - Vimeo and YouTub...