WordPress VideoJS plugins Cross-site Scripting (XSS)

Jijith Rajan

Published on

26 Jun 2018

Vulnerability

Cross-site Scripting (XSS) is a client-side code injection attack where, an attacker can execute malicious scripts into a website or web application. VideoJS HTML5 Player is a plugin that is used for video playback support on desktops and mobile devices. The self-hosted video files and video are externally hosted using VideoJS library. The old versions of WordPress has Video Player videoJS that is prone to a cross site scripting vulnerability. It is because it has failed to properly sanitise user supplied input. An attacker may misuse this issue to execute malicious script code in the browser.

Impact

This vulnerability is most prone to:-

Cross-site scripting.

Mitigation / Precaution

Automated human-like penetration testing for your web apps & APIs

Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Product tour

Written by