Stored Cross-Site Scripting Vulnerability in Video Share VOD Plugin for WordPress
CVE-2024-13393
6.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 18 January 2025
What is CVE-2024-13393?
The Video Share VOD plugin for WordPress is susceptible to a stored Cross-Site Scripting vulnerability through the 'videowhisper_videos' shortcode. This issue arises from inadequate input sanitization and output escaping of user-supplied attributes in all versions through 2.6.31. Authenticated attackers with contributor-level access or higher can exploit this weakness to inject malicious scripts. These scripts will execute in the context of users visiting the affected pages, posing significant risks to user data and site integrity.
Affected Version(s)
Video Share VOD – Turnkey Video Site Builder Script * <= 2.6.31