The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute within the 'wp:radio-player' Gutenberg block in all versions up to, and including, 2.0.78 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
Affected Vendors & Products
References
History
Tue, 24 Sep 2024 14:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Princeahmed
Princeahmed radio Player Live Shout Cast Ice Cast And Any Audio Stream Player For Wordpress |
|
CPEs | cpe:2.3:a:princeahmed:radio_player_live_shout_cast_ice_cast_and_any_audio_stream_player_for_wordpress:*:*:*:*:*:*:*:* | |
Vendors & Products |
Princeahmed
Princeahmed radio Player Live Shout Cast Ice Cast And Any Audio Stream Player For Wordpress |
|
Metrics |
ssvc
|
Tue, 24 Sep 2024 07:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute within the 'wp:radio-player' Gutenberg block in all versions up to, and including, 2.0.78 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
Title | Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute | |
Weaknesses | CWE-79 | |
References |
|
|
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-09-24T06:40:55.395Z
Updated: 2024-09-24T13:48:05.719Z
Reserved: 2024-08-28T16:32:36.145Z
Link: CVE-2024-8267
Vulnrichment
Updated: 2024-09-24T13:47:58.791Z
NVD
Status : Awaiting Analysis
Published: 2024-09-25T01:15:45.997
Modified: 2024-09-26T13:32:02.803
Link: CVE-2024-8267
Redhat
No data.