WordPress HTML5 Video Player < 2.5.27 - SQL Injection

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks id: CVE-2024-5522 info: name: WordPress HTML5 Video Player 2.5.27 - SQL Injection...

WordPress HTML5 Video Player - SQL Injection

WordPress HTML5 Video Player plugin is vulnerable to SQL injection. An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks. id: CVE-2024-1061 info: name: WordPress HTML5 Video Player - SQL Injection author: xxcdd severity: critical description: | WordPress HTM...

CVE-2024-5522-PoC

CVE-2024-5522-PoC : HTML5 Video Player 2.5.27 - 未認証SQLi このプラグインは、RESTルートから取得したパラメータをSQL文で使用する前にサニタイズやエスケープを行わないため、未認証ユーザーがSQLインジェクション攻撃を実行できてしまいます。 セットアップスクリプト: 1. git clone https://github.com/kryptonproject/CVE-2024-5522-PoC 2. cd CVE-2024-5522-PoC 3. pip3 install r requirements.txt 4. python3...

VulnCheck KEV: CVE-2024-5522

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-96531

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user,...

CVE-2026-96531 Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user,...

CVE-2026-96531

The Optimole WordPress plugin (versions 4.0.0 - 4.2.12 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element. This allows users with the Author r...

CVE-2026-96531 Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user,...

EUVD-2026-87539

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user,...

[SECURITY] Fedora 45 Update: qmplay2-26.08.02-2.fc45

QMPlay2 is a video and audio player. It can play all formats supported by FFm peg. It also supports Audio CD, raw files and chiptunes. It contains YouTube brows er...

[SECURITY] Fedora 45 Update: haruna-1.8.1-4.fc45

Open source video player built with Qt/QML and libmpv. Features: + play online videos, through youtube-dl; + supports youtube playlists; + toggle playlist with mouse-over, playlist overlays the video; + auto skip chapter containing certain words; + configurable shortcuts and mouse buttons; + quic...

Cross-site Scripting (XSS)

Overview paella-core is a Multistream HTML video player Affected versions of this package are vulnerable to Cross-site Scripting XSS via the caption cue text process. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious content into closed captions...

CVE-2026-84937

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

PT-2026-86360

🚨 CVE-2026-84937 The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

CVE-2026-84937: Improper Neutralization of Special Elements used in an SQL Command

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

WordPress HTML5 Video Player plugin <= 5.3.4.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin HTML5 Video Player versions = 5.3.4.0...

MAL-2026-7100 Malicious code in @vmo-community/video-player (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @vmo-community/video-player (npm)

--- -= Per source details. Do not edit below this line.=-...

[SECURITY] Fedora 44 Update: python-streamlink-8.4.0-1.fc44

Streamlink is a command-line utility that pipes video streams from various services into a video player, such as VLC. The main purpose of Streamlink is to allow the user to avoid buggy and CPU heavy flash plugins but still be able to enjoy various streamed content. There is also an API available...

CVE-2026-12135

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoplayer' shortcode 'align' attribute in all versions up to, and including, 7.5.51.7212 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...