MediaElement.js – HTML5 Video & Audio Player <= 4.2.8 - Contributor+ Stored XSS via Shortcode

2023-01-0300:00:00

Lana Codes

161

mediaelement.js

html5

stored xss

shortcode

alert trigger

0.001 Low

EPSS

Percentile

23.3%

JSON

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins.

1. Insert the following shortcode in a post/page: [mejsvideo type='" src="" onerror="alert(1)"']

2. Browse the post/page, and the alert will trigger successfully.

0.001 Low

EPSS

Percentile

23.3%

JSON

Related for WPEX-ID:E57F38D9-889A-4F82-B20D-3676CCF9C6F9