Cross-site Scripting Vulnerability in Bruce Video.js HLS Player
CVE-2025-27325

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Video.js Hls Player
Vendor
CVE Published:
24 February 2025

What is CVE-2025-27325?

The Video.js HLS Player, specifically versions up to 1.0.2, is susceptible to a DOM-Based Cross-site Scripting (XSS) vulnerability. This flaw stems from improper handling of input during the web page generation process, allowing malicious actors to inject harmful scripts into users' browsers. As a consequence, users may unknowingly execute these scripts, potentially leading to unauthorized access to sensitive information or manipulation of website content. It is crucial for users of Video.js HLS Player to review their security posture and apply necessary updates or mitigations.

Affected Version(s)

Video.js HLS Player 0 <= 1.0.2

References

https://patchstack.com/database/Wordpress/Plugin/videojs-...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

theviper17 (Patchstack Alliance)
.