Lucene search
Lana CodesWPEX-ID:58F82E13-153E-41E8-A22B-A2E96B46A6DCHistoryNov 22, 2022 - 12:00 a.m.
Videojs HTML5 Player < 1.1.9 - Contributor+ Stored XSS
2022-11-2200:00:00
Lana Codes
132
videojs
html5 player
stored xss
contributor
shortcode
page
post
exploit
EPSS
0.001
Percentile
25.1%
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
As a contributor, put the following shortcode in a page/post
[videojs_video url='" onerror=alert(/XSS/) "']
The XSS will be triggered when viewing/previewing the page/postRelated
prion
prion
Cross site scripting
2022-12-19 14:15:00
nvd
nvd
CVE-2022-3985
2022-12-19 14:15:11
wpvulndb
wpvulndb
Videojs HTML5 Player < 1.1.9 - Contributor+ Stored XSS
2022-11-22 00:00:00
patchstack
patchstack
cvelist
cvelist
CVE-2022-3985 Videojs HTML5 Player < 1.1.9 - Contributor+ Stored XSS
2022-12-19 13:41:40
cve
cve
CVE-2022-3985
2022-12-19 14:15:11