WordPress VideoJS plugins Cross-site Scripting (XSS)

Cross-site Scripting (XSS) is a client-side code injection attack where, an attacker can execute malicious scripts into a website or web application. VideoJS HTML5 Player is a plugin that is used for video playback support on desktops and mobile devices. The self-hosted video files and video are externally hosted using VideoJS library. The old versions of WordPress has Video Player videoJS that is prone to a cross site scripting vulnerability. It is because it has failed to properly sanitise user supplied input. An attacker may misuse this issue to execute malicious script code in the browser.

Impact

This vulnerability is most prone to:-

• Cross-site scripting.

Mitigation / Precaution

Written by

Jijith Rajan

Cyber Security Engineer