YouTube Embed, Playlist and Popup < 2.3.9 - Contributor+ Stored XSS
CVE-2021-24464

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Youtube Embed, Playlist And Popup By WPdevart
Vendor
CVE Published:
2 August 2021

Summary

The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise some of its shortcode options, available to users with a role as low as Contributor, leading to an authenticated Stored Cross-Site Scripting issue.

Affected Version(s)

YouTube Embed, Playlist and Popup by WpDevArt 2.3.9

References

https://wpscan.com/vulnerability/531b3fac-48b9-4821-a3aa-...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

apple502j
.