CVE-2021-24414 — MEDIUM (5.4)

Q: How severe is CVE-2021-24414?

CVE-2021-24414 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2021-24414?

Check the references section above for vendor advisories and patch information. Affected products include: Video Player For Youtube Project Video Player For Youtube.

Vulnerability Description

The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Video Player For Youtube Project	Video Player For Youtube	< 1.4

Related Weaknesses (CWE)

CWE-79

References

https://wpscan.com/vulnerability/e20b805d-eb11-4702-9803-77de276000acExploitThird Party Advisory
https://wpscan.com/vulnerability/e20b805d-eb11-4702-9803-77de276000acExploitThird Party Advisory

FAQ

What is CVE-2021-24414?

CVE-2021-24414 is a vulnerability with a CVSS score of 5.4 (MEDIUM). The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting p...

How severe is CVE-2021-24414?

CVE-2021-24414 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-24414?

Check the references section above for vendor advisories and patch information. Affected products include: Video Player For Youtube Project Video Player For Youtube.