PT-2026-33430 · WordPress · Videozen

Published 2026-04-17 · Updated 2026-04-24 · CVE-2026-6439

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions VideoZen versions prior to 1.0.2

Description The VideoZen plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping in the videozen conf() function. The lang POST parameter is stored via update option() without sanitization and subsequently displayed within a element without the use of esc textarea() or similar escaping functions. This allows authenticated attackers with Administrator-level access or higher to inject arbitrary web scripts into the plugin settings page, which execute when any user visits that page.

Recommendations Update to a version newer than 1.0.1. As a temporary workaround, restrict access to the plugin settings page to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-6439

Affected Products

Videozen

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-6439 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/47bcd04b-a479-49f2-94d0-df2a7684210c?source=cve · Note
• https://plugins.trac.wordpress.org/browser/videozen/tags/1.0.1/videozen-conf.php#L24 · Note
• https://plugins.trac.wordpress.org/browser/videozen/trunk/videozen-conf.php#L69 · Note
• https://twitter.com/CVEnew/status/2045102591567159358 · Twitter Post
• https://plugins.trac.wordpress.org/browser/videozen/trunk/videozen-conf.php#L24 · Note
• https://reddit.com/r/StopBadBots/comments/1su8tkw/unpatched_threat_why_you_must_remove_these_29 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2045104433223152037 · Twitter Post
• https://plugins.trac.wordpress.org/browser/videozen/tags/1.0.1/videozen-conf.php#L69 · Note