AI Score
Confidence
High
EPSS
Percentile
22.6%
SSVC
Exploitation
poc
Automatable
no
Technical Impact
partial
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
[
{
"cpes": [
"cpe:2.3:a:bplugins:html5_video_player:2.5.27:*:*:*:*:wordpress:*:*"
],
"vendor": "bplugins",
"product": "html5_video_player",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.5.27",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]