CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
WordPress Plugin Videos sync PDF 1.7.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by exploiting unsanitized mov, pdf, mp4, webm, and ogg parameters. Attackers can inject payloads like autofocus onfocus event handlers through the plugin options panel to execute arbitrary JavaScript when administrators view or edit video settings.
Explanation of Vulnerability in Simple Terms
Videos sync PDF versions 1.7.4 and later contain a cross-site scripting vulnerability. An attacker with low-level access can inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction to trigger. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.
What an attacker can do
Inject malicious scripts that run in other users' browsers to steal data or perform actions on their behalf.
Potential impact on your site
Users' accounts and data are at risk if they interact with pages containing injected scripts; attackers can impersonate users.
Conditions required to exploit
Low-level account access and the victim must click a link or visit a page containing the malicious payload.
Key dates
External resources
Related vulnerabilities
