CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Revolution Video Player With Bottom Playlist revolution-video-player allows Reflected XSS.This issue affects Revolution Video Player With Bottom Playlist: from n/a through <= 2.9.2.
Explanation of Vulnerability in Simple Terms
Revolution Video Player With Bottom Playlist versions up to 2.9.2 contain a cross-site scripting vulnerability. An attacker can inject malicious scripts that execute in a visitor's browser when they view a page containing the player. The vulnerability requires user interaction and can affect other parts of the site or steal session data. Update to a version newer than 2.9.2.
What an attacker can do
Inject malicious scripts that run in visitors' browsers when they view the affected player.
Potential impact on your site
Visitors' browsers can execute attacker-controlled code, potentially stealing credentials or session tokens.
Conditions required to exploit
Visitor must view a page containing the vulnerable player component; attacker needs network access.
Key dates
External resources
Related vulnerabilities
