WordPress VideoJS plugins Cross-site Scripting (XSS)

Jijith Rajan
Published on
26 Jun 2018

Cross-site Scripting (XSS) is a client-side code injection attack where, an attacker can execute malicious scripts into a website or web application. VideoJS HTML5 Player is a plugin that is used for video playback support on desktops and mobile devices. The self-hosted video files and video are externally hosted using VideoJS library. The old versions of WordPress has Video Player videoJS that is prone to a cross site scripting vulnerability. It is because it has failed to properly sanitise user supplied input. An attacker may misuse this issue to execute malicious script code in the browser.


This vulnerability is most prone to:-

  • Cross-site scripting.

Mitigation / Precaution

Automated human-like penetration testing for your web apps & APIs
Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Written by
Jijith Rajan
Jijith Rajan
Cyber Security Engineer
Find website security issues in a flash
Improve your website's security posture with proactive vulnerability detection.
Free website security assessment