CVE-2025-27325

WordPress Video.js HLS Player plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Feb 24, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruce Video.js HLS Player videojs-hls-player allows DOM-Based XSS.This issue affects Video.js HLS Player: from n/a through <= 1.0.2.

Analysis

AI-generated

Technical impact

The vulnerability is DOM‑Based XSS caused by improper sanitization of user‑supplied data generated by the Video.js HLS Player plugin. An attacker can craft inputs that execute arbitrary script in the victim's browser, leading to session hijacking, data theft, or defacement.

Affected Systems

The issue exists in the WordPress plugin Video.js HLS Player version 1.0.2 and earlier. Any site running Bruce's Video.js HLS Player plugin up to and including 1.0.2 is susceptible.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is below 1%, implying a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be web‑based, with an attacker inserting malicious data via the plugin’s rendering of video URLs or plugin configuration. Successful exploitation would allow the attacker to execute arbitrary scripts in the context of the site visitor.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a plugin release newer than 1.0.2 to mitigate the XSS flaw.
  • If upgrading is not immediately feasible, consider disabling or removing the Video.js HLS Player plugin until a patch is available.
  • Implement input validation or sanitation for any user‑provided video URLs that the plugin processes to reduce the risk of script injection.

Generated by OpenCVE AI on May 1, 2026 at 15:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-4353 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruce Video.js HLS Player allows DOM-Based XSS. This issue affects Video.js HLS Player: from n/a through 1.0.2.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruce Video.js HLS Player allows DOM-Based XSS. This issue affects Video.js HLS Player: from n/a through 1.0.2. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruce Video.js HLS Player videojs-hls-player allows DOM-Based XSS.This issue affects Video.js HLS Player: from n/a through <= 1.0.2.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruce Video.js HLS Player allows DOM-Based XSS. This issue affects Video.js HLS Player: from n/a through 1.0.2.
Title WordPress Video.js HLS Player plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:11 PM
Reserved
Feb 21, 2025, 4:45 PM

View source JSON

Updated
Feb 24, 2025, 4:54 PM

JSON

Status
Deferred
Published
Feb 24, 2025, 3:15 PM
Modified
Jun 17, 2026, 9:03 AM

View source JSON

No data.

Updated
May 1, 2026, 3:45 PM

JSON