CVE-2024-5522

The HTML5 Video Player WordPress plugin, in versions prior to 2.5.27 , is vulnerable to SQL injection because it fails to properly sanitize and escape a parameter from a REST route before including it in a SQL statement. This flaw allows unauthenticated users to execute arbitrary SQL queries, whi...