Cross-Site Scripting Vulnerability in Elite Video Player by CreativeMedia
CVE-2025-54044

7.1HIGH

Key Information:

Vendor

WordPress
Status
Elite Video Player
Vendor
CVE Published:
20 August 2025

What is CVE-2025-54044?

An input validation flaw in CreativeMedia's Elite Video Player permits attackers to execute arbitrary JavaScript in the context of a user's browser. This reflected Cross-Site Scripting (XSS) vulnerability can be exploited by crafting malicious links that hijack user sessions or redirect users to harmful sites. Affected versions of the Elite Video Player range from n/a through 10.0.5, highlighting the urgent need for users to adopt protective measures and update their systems.

Affected Version(s)

Elite Video Player <= 10.0.5

References

https://patchstack.com/database/wordpress/plugin/elite-vi...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anhchangmutrang (Patchstack Alliance)
.