PT-2024-14965 · WordPress · Html5 Video Player

Krzysztof Zając · Published 2024-01-01 · Updated 2024-01-08 · CVE-2023-6485

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Html5 Video Player WordPress plugin versions prior to 2.5.19

Description The issue arises from the Html5 Video Player WordPress plugin not sanitizing and escaping some of its player settings, combined with missing capability checks around the plugin. This could allow any authenticated users, such as subscribers, to perform Stored Cross-Site Scripting attacks against high-privilege users like admins.

Recommendations For versions prior to 2.5.19, update to version 2.5.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings to minimize the risk of exploitation. Additionally, ensure that capability checks are properly implemented around the plugin to prevent low-privilege users from performing sensitive actions.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-6485

Affected Products

Html5 Video Player

References · 8

• 🔥 https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81 · Exploit
• https://osv.dev/vulnerability/CVE-2023-6485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6485 · Security Note
• https://twitter.com/VulmonFeeds/status/1741878523571151142 · Twitter Post
• https://t.me/cvenotify/65950 · Telegram Post
• https://twitter.com/CVEnew/status/1741828985149968824 · Twitter Post
• https://t.me/cibsecurity/74093 · Telegram Post
• https://t.me/cvenotify/65903 · Telegram Post