Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Videowhisper | Live Streaming Integration Plugin | 4.27 |
| Videowhisper | Videowhisper Live Streaming Integration | <= 4.27.4 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/125454Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/91477
- https://www.htbridge.com/advisory/HTB23199Exploit
- http://packetstormsecurity.com/files/125454Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/91477
- https://www.htbridge.com/advisory/HTB23199Exploit
FAQ
What is CVE-2014-1906?
CVE-2014-1906 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via ...
How severe is CVE-2014-1906?
CVE-2014-1906 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-1906?
Check the references section above for vendor advisories and patch information. Affected products include: Videowhisper Live Streaming Integration Plugin, Videowhisper Videowhisper Live Streaming Integration.