CVE-2023-6485

Html5 Video Player < 2.5.19 - Subscriber+ Stored XSS

CVSS 5.4 MEDIUMEPSS 0.5%

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.4EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

01 Jan 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

Unknown · Html5 Video Player

References

https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81