NPM: Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

NPM: Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text vulnerability discovered by ? in WordPress Npm paella-core versions 1.50.6...

Cross-site Scripting (XSS)

Overview @asicupv/paella-core is a Multi stream HTML video player Affected versions of this package are vulnerable to Cross-site Scripting XSS via the caption cue text process. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious content into close...

Cross-site Scripting (XSS)

Overview paella-core is a Multistream HTML video player Affected versions of this package are vulnerable to Cross-site Scripting XSS via the caption cue text process. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious content into closed captions...