PT-2024-28472 · WordPress · Playlist For Youtube Wordpress Plugin

Erdemstar · Published 2024-05-29 · Updated 2024-10-03 · CVE-2024-3937

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Playlist for Youtube WordPress plugin versions 1.32 and earlier

Description The issue concerns a Stored Cross-Site Scripting attack. High privilege users, such as admins, can exploit this even when the unfiltered html capability is disallowed, for example, in multisite setups. The vulnerability arises from the plugin's failure to sanitise and escape some of its settings.

Recommendations For versions 1.32 and earlier, update to a version that addresses this issue. As a temporary workaround, consider restricting the ability of high privilege users to modify plugin settings until a patch is available. Avoid using potentially malicious input in settings such as the Playlist Name and Video size.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-3937

Affected Products

Playlist For Youtube Wordpress Plugin

References · 8

• 🔥 https://wpscan.com/vulnerability/0cd5b288-05b3-48b7-9245-f59ce7377861 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-3937 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3937 · Vendor Advisory
• https://t.me/cvenotify/81337 · Telegram Post
• https://twitter.com/AWNetworks/status/1810297087411487030 · Twitter Post
• https://twitter.com/ChannelSkell/status/1810362232305266956 · Twitter Post
• https://twitter.com/ChannelSkell/status/1810690672589984096 · Twitter Post
• https://twitter.com/ksg93rd/status/1841888089704214544 · Twitter Post