CVE-2024-53779 HIGH

CVE-2024-53779: WordPress Yahoo! WebPlayer plugin <= 2.0.6 - CSRF to Stored XSS vulnerability

Vendor 8Bitkid

Product Yahoo! WebPlayer

Weakness CWE-352 · CSRF

Published December 2, 2024

Last update May 12, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in 8bitkid Yahoo! WebPlayer yahoo-media-player allows Stored XSS.This issue affects Yahoo! WebPlayer: from n/a through <= 2.0.6.

Explanation of Vulnerability in Simple Terms

02Summary

Yahoo! WebPlayer versions 2.0.6 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a logged-in user, performs unwanted actions on their behalf. The vulnerability requires user interaction—the victim must visit the attacker's page—but can affect confidentiality, integrity, and availability of the user's session.

What an attacker can do

03Attacker Capabilities

Perform unwanted actions on a user's account by tricking them into visiting a malicious webpage.

Potential impact on your site

04Site Impact

Users' accounts and data are at risk if they visit untrusted sites while using Yahoo! WebPlayer.

Conditions required to exploit

05Prerequisites

User must be logged in and visit an attacker-controlled webpage.

Key dates

06Disclosure timeline

December 2, 2024 CVE published

May 12, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-53779 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities