Lucene search
Lana CodesWPVDB-ID:FDAD356F-CAE4-4390-9A62-605201CEE0C0HistoryJan 26, 2023 - 12:00 a.m.
Video.js - HTML5 Video Player for WordPress <= 4.5.0 - Contributor+ Stored XSS via Shortcode
2023-01-2600:00:00
Lana Codes
wpscan.com
12
wordpress
plugin
xss
0.001 Low
EPSS
Percentile
23.3%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
PoC
[videojs mp4=‘" onerror=“alert(/XSS/)”’]
| CPE | Name | Operator | Version |
|---|---|---|---|
| videojs-html5-video-player-for-wordpress | eq | * |
Related
cve
cve
CVE-2022-4786
2023-02-21 09:15:11
prion
prion
Cross site scripting
2023-02-21 09:15:00
cvelist
cvelist
nvd
nvd
CVE-2022-4786
2023-02-21 09:15:11
wpexploit
wpexploit