CVE-2023-6485 — Html5 Video Player < 2.5.19 - Subscriber+ Stored XSS

Description (CNA)

The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins

Affected (CNA)

Vendor / product	Versions
Unknown / Html5 Video Player	affected 0 before 2.5.19

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81

ADP enrichment

CVE

No English description supplied.

https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81

CISA-ADP

No English description supplied.

No references supplied.