PT-2026-39478 · WordPress · Videos Sync Pdf

Und3Sc0N0C1D0 · Published 2026-05-10 · Updated 2026-05-10 · CVE-2022-50949

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Videos sync PDF version 1.7.4

Description An authenticated attacker can inject malicious scripts through the plugin options panel. This occurs due to unsanitized input in the nom, pdf, mp4, webm, and ogg parameters. By using payloads such as autofocus onfocus event handlers, an attacker can execute arbitrary JavaScript when administrators view or edit video settings. This is a stored cross-site scripting issue, where the malicious script is permanently stored on the server and executed in the browser of the victim.

Recommendations As a temporary workaround, restrict access to the plugin options panel or avoid modifying the nom, pdf, mp4, webm, and ogg parameters until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-50949

Affected Products

Videos Sync Pdf

References · 5

• 🔥 https://exploit-db.com/exploits/50874 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50949 · Security Note
• https://twitter.com/CVEnew/status/2053537463398961415 · Twitter Post
• http://a-j-evolution.com · Note
• https://vulncheck.com/advisories/wordpress-plugin-videos-sync-pdf-stored-xss · Note