CVE-2023-6485

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6485
The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81 Exploit Third Party Advisory
https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:bplugins:html5_video_player:*:*:*:*:*:wordpress:*:*
History

21 Nov 2024, 08:43

Type Values Removed Values Added
References () https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81 - Exploit, Third Party Advisory () https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81 - Exploit, Third Party Advisory

08 Jan 2024, 19:31

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
CWE CWE-79
References () https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81 - () https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81 - Exploit, Third Party Advisory
First Time Bplugins
Bplugins html5 Video Player
CPE cpe:2.3:a:bplugins:html5_video_player:*:*:*:*:*:wordpress:*:*
Summary (es) Html5 Video Player WordPress plugin anterior a 2.5.19 no sanitiza ni escapa a algunas de las configuraciones de su reproductor, lo que, combinado con la falta de comprobaciones de capacidad en torno al plugin, podría permitir que cualquier usuario autenticado, como suscriptores bajos, realice ataques de Cross-Site Scripting almacenado contra usuarios con altos privilegios como administradores (es) El complemento Html5 Video Player de WordPress anterior a 2.5.19 no sanitiza ni escapa a algunas de las configuraciones de su reproductor, lo que, combinado con la falta de comprobaciones de capacidad en torno al complemento, podría permitir que cualquier usuario autenticado, como suscriptores bajos, realice ataques de Cross-Site Scripting almacenado contra usuarios con altos privilegios como administradores

02 Jan 2024, 13:47

Type Values Removed Values Added
Summary
  • (es) Html5 Video Player WordPress plugin anterior a 2.5.19 no sanitiza ni escapa a algunas de las configuraciones de su reproductor, lo que, combinado con la falta de comprobaciones de capacidad en torno al plugin, podría permitir que cualquier usuario autenticado, como suscriptores bajos, realice ataques de Cross-Site Scripting almacenado contra usuarios con altos privilegios como administradores

01 Jan 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-01 15:15

Updated : 2024-11-21 08:43

NVD link : CVE-2023-6485

Mitre link : CVE-2023-6485

CVE.ORG link : CVE-2023-6485

JSON object : View

Products Affected

bplugins

  • html5_video_player
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')