Stored Cross-Site Scripting Vulnerability in VideoZen Plugin by WordPress

CVE-2026-6439

What is CVE-2026-6439?

The VideoZen plugin for WordPress has a vulnerability that allows an authenticated attacker with Administrator-level access to exploit stored Cross-Site Scripting (XSS). This occurs because the plugin's videozen_conf() function does not adequately sanitize input or escape output. Specifically, the 'lang' POST parameter gets stored via update_option() without sanitization and then displayed in a element without using appropriate escaping functions like esc_textarea(). As a result, attackers can inject arbitrary web scripts into the plugin's settings page, executing malicious content whenever users access that page.

References